Annual Performance Reviews – love or hate ’em ?


The time between Thanksgiving and the Holiday Season break is most typically when companies review their employees performance. Most everyone has their views on Annual Performance Reviews since we are all involved either as a reviewer or reviewee. I created the following poll on LinkedIn to gauge what people thought about the annual review process – take a look here. I was very surprised by the results.

The post today is not a lesson in Human Resource Management, but I do often think about how people in Compliance, Legal and Information Security are really reviewed in terms of their job performance. In sales its easy – how much did you sell?

The conversation for a Compliance Officer or a Chief Security Officer is more complicated – how many FCPA infractions did you investigate or how many security breaches did you uncover? These roles are about protection and prevention and for the most part the teams operate in stealth mode and are seen to be doing their best work when nothing bad is happening. So a good performance review is about “nothing bad happened or nothing bad was uncovered”. Right? Wrong!

The best Compliance or Security Officers are actually “looking for bad stuff”, they are not sitting back complacently believing that their fort is secure. The very fact that “bad stuff has not happened” is the very reason to look harder. They are pre-emptive or pro-active and their mantra is to “find bad stuff before it happens”. Lofty aspirations, perhaps?

So shouldn’t performance be [at least partly] measured on vigilance and awareness rather than simply policies, processes and how well a team reacts to bad stuff as and when it happens?

Believe it or not we come across the “don’t tell me what I don’t want to know” attitude everyday. Catelas has an ability to look inside the business and monitor, yes monitor, how business gets done. Or more accurately we visualize the communications patterns of a company to understand “who knows who” and “how well”. For compliance and security groups we are used as a monitoring solution to better understand company relationships – who in my company has relationships with X, where you can fill in the blank X to be competitor, press, government official, etc.

But my point is that for many companies we often have to water down the “monitoring” term because our audience (the Compliance or Security Officer) does not want to look deeper than the job dictates. They are not interested in pro-actively seeking out potentially bad stuff for fear of finding something. Sure I understand that these teams are max’ed out or are operating within the Risk Profile of their company, etc, but in this age of Whistle-blowers and Self-Reporting, I honestly believe that the CCO in particular needs to step out of his or her comfort zone and start being more proactive. Blind ignorance is no longer an excuse.

What do you think?

Advertisements

Pharma’s in the cross-hairs – turning up the heat!


There seems to be a lot of heat in the Pharma compliance kitchens right now with a series of federal investigations and settlements. Stephanie Rabiner’s blog post summarizes the recent activity –  “Glaxo pays $3B fine, Pfizer paid $2.3 billion in 2009, while Eli paid $1.4 billion the same year. And Abbott Laboratories agreed to a $1.3 billion settlement in recent weeks.”

These cases center around fraud, off-label promotions and/or kickbacks and many go back over the last 10 years. Viewed holistically and considering the consumer suits that accompany these federal one’s, it is a very big deal. The Pharma Industry is certainly in the cross-hairs right now. And the heat is being turned up.

Another blogger, Richard Cassin, last month wrote about “a flock of Pharmas”, asking the question, was the Pharma industry simply prone to these types of investigations, given the business they are in?

The allegations being investigated are certainly broad – the illegal marketing of a number of drugs, de-frauding the Medicaid program, FCPA violations, to name a few. Is this the culmination of the big investigations or is this the tip of the ice-berg?

I also looked a little closer into the Pfizer case, started by a whistle-blower lawsuit. Turns out that the list of 10 whistle-blowers includes two former employees who had spent 24 years and 16 years respectively with Pfizer.  Long careers certainly, long memories, perhaps? This is not to say that the industry is inherently corrupt, but like the financial services industry, which was placed under massive scrutiny following Madoff, these types of investigations force every company in the industry to look in the mirror.

Given the revelations coming out of Penn State University this week, I would say that every Compliance Officer should be looking a little harder into their company’s Ethics programs to be sure that their company is not the next big Wall Street head-line.

How well do you know your Partners and 3rd Parties?


Reading through the Mike Volkov and Tom Fox blogs certainly provides food-for-thought around FCPA violations and infringements. Mike is holding a webinar next week to talk about FCPA with respect to Private Equity and Hedge Funds, in particular when such companies are considering international mergers or acquisitions; Tom talks about whether FCPA scrutiny revolves around the oil and gas company because of the places where they operate or the ‘cowboy tradition’ of the industry.

These articles got me thinking about the partners and 3rd parties that such companies contract with to conduct business in countries like Russia, China and Mexico. My question for companies with significant international operations is simply “How well do you really know your Partners and 3rd Parties?” I posed a similar question in my blog last month, but the point is worth repeating.

Most companies it seems, who are expanding their international businesses or looking at potential M&A activity, do a pretty good job at the front end – ie the due diligence stage. Vetting partners, 3rd party relationships, etc. The problem is that business relationships are not static – they change and evolve. Personnel changes, from sales to research and development teams to supply chain partners. With these changes, so does ‘who we do business with’ and more importantly ‘how business is conducted’.

At Catelas we are not advocating that companies need to monitor every business relationship every minute of the day, but we certainly recommend regular check-ups (or assessments). For example, a company might be have expanded its business operations into South America. Well it would not hurt to conduct a business partner / 3rd party assessment after 1 year to examine what those business relationships look like. Or a major pharma company conducting clinical trials in Indonesia may find it makes sound business sense to identify the key relationships that exist between the company, partners, 3rd parties and hospitals, six month into those trials.

As this picture shows, these 360 degree assessment need not be a massive, expensive investigation in-country. Nor is it a major audit of the company’s financials and partnership contracts. Rather they are designed to be a non-obtrusive examination of how  business is really being done on a day-to-day basis – ‘who is talking to who’, and ‘what are the key business relationships in place’. It provides first and foremost ‘peace of mind’ that the company is conducting business ethically. But if red flags are raised as a result of the assessment, then it provides a process for undertaking a more detailed examination.

And hence the MRI analogy we have used before – the Catelas 360 degree assessment provides an MRI into your foreign business operations – answering the question “How well do you know your 3rd parties?”. To learn more take a look here or give us a call. I would love to hear your views.

What does an MRI and Enterprise Risk have in common?


Do you remember the days of X-rays when a GP would hide behind a screen and a huge puff of smoke would erupt from some weird-looking industrial type camera. Bygone days when surgeons operated with precious little knowledge about the patient’s condition. Risky business!

Today surgeons make use of sophisticated MRI’s, endoscopes and the like to perform key-hole surgery. Not only do they pinpoint the exact cause of the ailment before they operate, but the corrective procedures are conducted in a fraction of the time.

I use this MRI analogy for the work we are doing at Catelas. As I mentioned in my Gaping Hole in the EDRM post a week ago, what we do is provide Early Case Intelligence about a matter before the ‘operation’ of collection, processing and review takes place. Like a surgeon today, who would NOT conduct an MRI before operating on the patient?

Likewise, in the area of Compliance, specifically for Financial Services, we provide comprehensive surveillance of Information Barriers and Watch Lists. Because we can monitor an entire company’s communications patterns pro-actively, the company is leaving nothing to chance.

And just like a surgeon who knows how to read an MRI, we can immediately uncover enterprise risk that prompts the Compliance Officer to take further action.

My key point here about Enterprise Risk is that companies in many ways are operating like the surgeons of old – they do not have MRI’s to help them pinpoint precisely where the risks are. In eDiscovery or Compliance this is the role Catelas plays – helping you assess the risk before you start a widespread and costly collection and review operation.