Episode 15: Why compliance isn’t boring

December 11, 2019

Whether we realize it or not, the field of regulatory compliance impacts almost every aspect of our lives. From the food we eat to the contracts we sign to the way we catch lobsters, we are impacted by a variety of laws and regulations that make up the surprisingly dynamic field of compliance. This episode focuses on how compliance is more than following rules. Done well, compliance uses creativity, critical thinking, and strategic planning to empower employees, build an ethical business culture, and strengthen brand reputation. We also explore the cautionary tales of companies like Wells Fargo and Theranos to better understand the consequences of noncompliance.

Also available on:

 

Notes

 
Episode Notes

Whether we realize it or not, the field of regulatory compliance impacts almost every aspect of our lives. From the food we eat to the contracts we sign to the way we catch lobsters, we are impacted by a variety of laws and regulations that make up the surprisingly dynamic field of compliance. This episode focuses on how compliance is more than following rules. Done well, compliance uses creativity, critical thinking, and strategic planning to empower employees, build an ethical business culture, and strengthen brand reputation. We also explore the cautionary tales of companies like Wells Fargo and Theranos to better understand the consequences of noncompliance.

Andrew Kaufman joined the University of Maine School of Law faculty in 2016, after more than 40 years in private practice as a corporate and transactional attorney.  At Maine Law, Andy teaches advanced courses in corporate law and business associations, commercial law, and transactional practice, as well as the law school’s course in risk management and compliance.  In addition, he is the Director of the Compliance Certificate Program that the law school offers to compliance professionals in the business community.  Andy received his bachelor’s degree from Yale in 1971 and his law degree from Vanderbilt University Law School in 1974.

Ross Hickey is the Assistant Provost for Research Integrity at the University of Southern Maine and the Director of MeRTEC (“MER-tech”), the Maine Regulatory Training and Ethics Center at USM. Ross has built a nationally-recognized research compliance office that serves not only USM, but institutions throughout the State of Maine. Ross is contacted on a regular basis to provide technical assistance to other institutions on regulatory compliance matters. Ross is a graduate of the University of Maine School of Law.

***

Connect with Us

Website: umainecenter.org/greatergood

Twitter: @greatergoodpod

Produced by the University of Maine Graduate and Professional Center, with help from WMPG

Episode Sources

 

Episode Guests

Andrew Kaufman joined the University of Maine School of Law faculty in 2016, after more than 40 years in private practice as a corporate and transactional attorney.  At Maine Law, Andy teaches advanced courses in corporate law and business associations, commercial law, and transactional practice, as well as the law school’s course in risk management and compliance.  In addition, he is the Director of the Compliance Certificate Program that the law school offers to compliance professionals in the business community.  Andy received his bachelor’s degree from Yale in 1971 and his law degree from Vanderbilt University Law School in 1974.

Ross Hickey is the Assistant Provost for Research Integrity at the University of Southern Maine and the Director of MeRTEC (“MER-tech”), the Maine Regulatory Training and Ethics Center at USM. Ross has built a nationally-recognized research compliance office that serves not only USM, but institutions throughout the State of Maine. Ross is contacted on a regular basis to provide technical assistance to other institutions on regulatory compliance matters. Ross is a graduate of the University of Maine School of Law.

Disclaimer

The information provided in this podcast by the University of Maine System, acting through the University of Maine Graduate and Professional Center, (the University) is for general educational and informational purposes only. The views and opinions expressed in this podcast are those of the author(s) and speaker(s) and do not represent the official policy or position of the University. Assumptions made in the analysis are not reflective of the position of any entity other than the author(s) and speaker(s) – and, since the author(s), speaker(s) and listeners are critically-thinking human beings, these views are always subject to change, revision, and rethinking at any time. All information in the podcast is provided in good faith, however the University makes no representations or warranties of any kind, express or implied, regarding the accuracy, adequacy, validity, reliability, availability or completeness of any information in the podcast and will not be liable for any errors, omissions, or delays in the information in this podcast or any losses, injuries, or damages arising from its broadcast or use. It is the listener’s responsibility to verify their own facts. Your use of the podcast and your reliance on any information in the podcast is solely at your own risk. The podcast does not contain nor is it intended to contain any legal advice. Any legal information provided is only for general informational and educational purposes, and is not a substitute for legal advice. Accordingly, before taking any actions based upon such information, the University encourages you to consult with an appropriate legal professional or licensed attorney.

Transcript

​This transcript has been lightly edited for clarity.

***

The Greater Good: Episode 15

Carrie: Welcome to the Greater Good: a podcast devoted to exploring complex and emerging issues in law, business and policy. I’m your host Carrie Wilshusen, Associate Dean for Admissions at the University of Maine School of Law.

Carrie: We are joined today by Andrew Kaufman, professor of practice and director of the compliance program at the University of Maine School of Law and Ross Hickey, assistant provost for research integrity at the University of Southern Maine and a graduate of Maine Law. Welcome gentlemen. Thank you so much for joining us today. 

Ross/Andy: Well, thank you for inviting us. 

Carrie: We’re talking about compliance today and I’m going to start right off the bat: tell me why compliance isn’t boring. 

Ross: Well, it’s a real softball question to start it off, right. Well, I think if for folks that have any connection to the state of Maine and you have any commercial fishermen in your family, you are probably discussing a lot of new ideas and concepts around the regulations that impact the lobstering industry in the state of Maine. And this is the attempt to try to protect the right whale. And that process is bringing to light a lot of things that probably people haven’t been given a lot of thought to in their past. They haven’t thought a lot about how new informal rulemaking processes are promulgated at the federal government and what that means. But now for a lot of folks, particularly those that fish in the state of Maine, they’re learning about that process very quickly and trying to understand it. So I think that’s a great example of how we may think of compliance as this boring idea, but much of what we’re trying to do goes right to the heart of what directly impacts not only ourselves, but people in our family, friends and family. There’s really very little in life that does not have some sort of compliance aspect. And it’s more than just regulations, but regulations are certainly a part of that. Well, and the source of compliance and the need for compliance I think gives you an insight into why it’s not boring. 

Andy: Think about compliance as the way that we identify the norms of behavior that we think are appropriate and then how we line up the people inside the organization so that they all pull on the oars at the same time, in the same direction and create throughout the organization a culture that makes it more likely rather than less likely that the targeted and desired norms of behavior will be achieved. It’s not simply training people follow the rules. We talked about it as the people responsible for compliance and an organization being the great puzzle masters of the organization. Right. Um, you know, think about where the need for establishing norms of behavior might come from. Now, you know, Ross, you mentioned a moment ago, governmental regulation, regulating how lobsterman are going to run their lines so that we don’t impact the right whale. So certainly a lot of compliance generates from law or regulation imposed upon us by governmental organization.

Ross: And then you have also municipalities probably not going to happen much with lobsters, but for other shellfish, uh, clamming you’re going to have local municipalities are going to have their own regulations. So it’s not just the federal government that impacts us. Um, it could be a whole host of other entities, governmental, it could even be international. Um, they can impact, uh, the business that you’re trying to help maintain compliance with. 

Carrie: So Ross, could you talk a little bit about the genesis of compliance? How, how did we get here? 

Ross: The interesting thing is if you look at a specific area like research compliance, which is much of what I do at the university, many of what people think and assume have been in place since the dawn of time are all relatively recent protections. And so in that situation, the first real codifications of rules around what ethical behavior should be done by researchers with folks that are their subjects started after world war II. And it came out of the horrifying details that we all learned through the Nuremberg trials and the atrocities committed by folks like Dr Mengele who was experimenting on folks in concentration camps and with no ethical compass at all. And so you see many of the things that you would just assume have always been the case came not that long ago. And things like having the choice whether to be experimented on it or not as a person, the ability to understand what’s being done to you. The idea that before you do work, uh, and use human beings as subjects, there needs to be some sort of foundational work done with animals first. All of those came out of the Nuremberg code, which were really in the aftermath of world war II.

If you look at the FDA oversight and regulations, much of that came out of historical events as well, such as the thalidomide atrocity that occurred in Europe and in Canada. If it wasn’t for Dr (Frances) Kelsey at the FDA who reviewed the application to use the drug thalidomide, which was a sedative that was often prescribed to pregnant women and reading and, and seeing that there really wasn’t the thorough due diligence on the literature review and some other pieces of that needed to be in place and holding up the approval if it wasn’t for her. Uh, which was interestingly one of her first, uh, reviews she was given as an employee of the FDA. If it wasn’t for her heroic work, we could have had the same thing happen in the US that happened in Europe and in Canada, which was the unfortunate side effect with the babies that were born from women who had been taking thalidomide. They were born with a flipper like hands and feet. Their limbs were not fully developed. 

So those, that’s another example of why we have the monitored rules and regulations from the FDA oversight of investigational new drugs, new medical devices as well. There was a landmark article in the New England Journal of Medicine from the 1960s by a Dr (Henry) Beecher that shared many of the things that were going on where there were no standards, no rules, that doctors could give you experimental drugs and you wouldn’t know it and they could also do direct harm to you and there was no protection for the subjects involved. 

You see, another example of how we got the modern rules and regulations came again not that long ago in the early 1970s with the an Associated Press reporter wrote an expose piece on work that had been done by the federal CDC with untreated syphilis and it was in the untreated syphilis study with Tuskegee patients, down at the Tuskegee Institute. And these were folks that had advanced syphilis. And again, when the study started in the early 1930s, there was no treatment for syphilis. But as the study went on, it was a longitudinal study and world war II happened in the use of penicillin as an effective treatment of syphilis was discovered. There was no attempt to try to give that treatment to the folks that were taking part in the study. And the interesting thing was you see the culture and we get, we’ve talked about the culture already where the folks at the CDC weren’t hiding this study. They didn’t, weren’t ashamed of this study. They actually were quite proud and most of the most prominent people in the CDC at one point or another had taken part in doing the research. And so it really was until there was the public outcry from this article where people realized what had happened, that Congress held hearings and the modern regulations we have in place, uh, through the national research act were created in 1974 have been changes over the years.

But those are the ones we have in place. It may seem like a long time ago, but to think that 1975 to 2019 that prior to that a lot of the standard protections that we take for granted were not in place. So there’s a great case study of how compliance and regulations developed. They mostly developed in reaction to horrible events and people saying never again, we could debate whether those actual regulations did what was intended, but they were created out of a response. Rarely do people proactively create these things are usually done in reaction to, I think that we’ve talked about ways in which compliance can be forward thinking. That’s usually trying to gain a, a, a uh, an advantage, uh, business wise. And I think that that certainly can happen, but many of the federal regulations we talk about because they take so long to develop usually our response to something that’s occurred. 

Carrie: So one of the things I want to do, before we go on to some of the stories of how this is playing out, can you each talk a little bit about what your role is in compliance now? So let’s start with Andy. You, you started out in private practice as an attorney?

Andrew:  I was in private practice as a corporate and transactional lawyer for over 40 years. 

Carrie: And so you weren’t the compliance guy? 

Andy: No, no, I represented clients doing deals. Now when you represent clients doing deals, putting transactions together, uh, advising clients on what they’re allowed to do and not do you, you are in a sense playing a compliance role. You’re identifying for clients behavior that is permitted behavior that is not permitted behavior that is in that ambiguous gray area that we talk a lot about. And that uh, uh, non-lawyers find very frustrating about lawyers. Uh, so my role as a transactional attorney, a corporate attorney advising clients, uh, was to help them put transactions together or to identify and embrace behavior and conduct that, uh, would make it more likely rather than less likely that their business and transactional goals would be achieved and make it more likely rather than less likely that they would stay on the right side of the behavioral line that we all draw on the sand in

In so doing now I undertook to teach a course [at Maine Law] focused entirely on risk management and compliance and uh, to help students interested in the area, learn what the rules are for risk management and compliance. Initially this was for JD students, students in the law school, uh, students who wanted to develop some expertise, uh, for how the law, uh, deals with compliance, uh, where do compliance people get off base, where can they get into trouble? Where can compliance efforts fail? What are the consequences for organizations, uh, uh, for noncompliance? These are fairly traditional lawyer roles, lawyer perspectives, um, a in an area that we might call risk management and compliance.

Ross: And that really speaks to the needs that are out there right now to find folks that have many of the skills that a traditional JD program helps to foster and grow. Those are well suited to the field of compliance. You don’t have to be a lawyer to be in compliance, but you see that there is a great desire to have folks who have the JD background in there, these operations in these organizations because they come in with the critical thinking skills and also that ability to live as Andy was saying in the gray.

Carrie: So um, we’re going to talk about the gray a little bit, but now you’re, you’re also teaching and you and Ross together are working on this compliance program for non attorneys, right? 

Andy: Absolutely. This has been a very exciting development for us and I’ve, it’s been particularly personally satisfying to be able to work with Ross in the development of this program. And uh, to be specific, this is not a program for lawyers that we’re talking about. We call it the compliance certificate program. And it’s a program that Ross and I have, uh, developed and put together that offers compliance training, skill training or compliance professionals. Uh, at this point, targeting businesses in the Southern Maine region. Uh, Ross came to us, uh, talking about compliance training he was doing in his undergraduate [classes]. 

Carrie: Let’s hear from Ross about what, what do you do, Ross? What is your role? Cause you are, you’re an attorney, you’re not in a practice, you’re not practicing law. 

Ross: Right. So I grew up in Maine, went to Maine Law as you mentioned, and have the role and responsibility of making sure that for USM, we are in compliance with the myriad of regulations that are in place, mostly at the federal level that deal with our research and funded grants and contracts that come into the university. So like many universities, in addition to the instruction of our students, we do research, we create new knowledge in various fields, and much of that is funded and it’s funded through private entities and foundations. And a large portion of it comes through federal funds and fund wrote federal grants. Well, when the feds give you that money, uh, they have certain things they want to see in place. Certainly the regulations that deal with the type of work you’re doing. But then there’s a whole host of other things that a institution like USM agrees to do in order to get that money.

Ross: And so once you’ve signed those assurances, you then have to create a culture of compliance in order to maintain and continue to receive the funding. So that role at the university is housed in my office. That’s the Office of Research, Integrity and Outreach. And so for all of the various rules and regulations that we have to follow contractually or through regulatory oversight, we are responsible for maintaining those and keeping the compliance. In addition to that, we as Andy mentioned, heard from folks in our community throughout Maine that one of the skillsets and one of the areas that they were in particular need of new professional, uh, folks coming out of school and graduating to have, was in the area of compliance. And so this was one of those areas where USM and the University of Maine System said to respond to that need in the community, we need to start to build different types of educational curriculum at their and scaffold that to touch various folks in this profession.

Ross: So let me give you examples of that. At the undergraduate level we developed a regulatory ethics program, which means that USM graduates come out of a USM with either a certificate or a minor in regulatory ethics that teaches many of the principles of how you navigate the regulatory oversight, how you navigate the road that you’re on, what those guard rails are and how do you ensure that those don’t become roadblocks to stopping the organization you work for. And we’ve got the certificate program for those already in the profession. These are folks that many times are coming from some of the bigger employers in the state of Maine. They’ve already been in their career for several years and they’re looking for tips, strategies, approaches they can put in their toolkit for what they do every day and utilize to help to create a more effective compliance operation at their organization.

Carrie: Okay, so why isn’t this boring? You’re making, you know, you’re this, the compliance person is making people follow the rules, right? Why isn’t that boring?

Ross: Well, as we said, it’s very challenging to make anybody do something that they have no inclination to do. So what you’re really doing is helping to equip folks and empower them to do things that we go in with the approach that they want to do, that they want to follow and do the right thing. And we’re helping them to make those decisions in a way so that they actually are doing the right thing. And staying out of trouble is not just about staying out of jail. It’s also about helping to have a better competitive advantage over others because your operation being proactive, forward thinking and getting out in front in front of things that are impacting a lot of folks. What happens and what a good, strong compliance operation understands and appreciates. Is there is stress and tension that’s impacting people who are normally going to do the right thing to behave in a different way because they feel like they have no choice. 

Carrie: Can you give me an example of that? 

Ross: So I think we’ve talked about, and we can give lots of examples of that throughout history, but also some things that are right in the paper right now. One that we talk about is the Wells Fargo case. 

Andy: Wells Fargo, one of the issues that was raised, uh, was the fact that some line operators, lower level, uh, people in the banks were opening up, uh, unauthorized bank accounts, uh, for customers, uh, in order for them the line officers to satisfy performance goals that were being imposed upon them by middle level and upper level management. And we use this as an example, uh, of to illustrate how a perfectly legitimate business goal executed without proper attention to compliance can go awry there. There’s nothing that’s wrong with a company saying, we want to grow. One of the ways we grow is by opening up new business. And in point of fact, uh, nobody was telling these lying people to go and do that behavior. But what was created, uh, according to the press reports, um, was a culture in which there was so much pressure rock to bear on the line people, Oh, we responsible for creating and generating new business that, uh, somebody figured out, well this was a way to get it done. And then someone else saw that guy doing it and said, well, I’ll do it too and we’re not getting caught. And you end up creating a culture of misbehavior that was not identified, was not flagged, and frankly was not prevented because of the failure of the compliance culture at the organization. 

Ross: So let’s throw some other ones [in]. In my area, which is my every day work that I do for the university deals with research and where things can go wrong within the research that is being conducted. And so there’s many times, many examples that you see that hit the headlines of where, again, for a terrific purpose that would help society. We, you think of the [Anil] Potti case out of Duke where they were trying to come up with more effective ways to treat cancer. You think of the Theranos case out of California where they were creating a new innovative way to do analysis on blood by simply having get a blood draw through pricking the finger as opposed to having you the use of needles. These were great ideas and concepts. Somewhere along the line there was the rush to get the commercialization of these things out or the process of the new intervention before the right type of rigor had been done to actually ascertain whether it was effective or not or not.

If you look at those cases, almost invariably there is again, probably well-meaning folks who decide that they need to cut the corners, whether those are the regulatory corners, whether those are their own processes of quality control. And so we’ll catch up on those things, we’ll figure that out later. But we need to keep moving forward because this impacts so many people where people start to question cases. 

Carrie: I am not familiar with this. 

Ross: So with the Theranose case, you had an example where you had, uh, ultimately a organization that created this new method of drawing blood from individuals just by, uh, pricking their finger. That was not only something that got a lot of attention. It had an entity like Walgreens that decided they were going to buy into this and started to set up a place where people could have this work done.

Well, when they did the work, there was no new analysis done. The only way that they could do the, did the normal analysis was taking drawing blood the old fashioned way. And so that created a, they thought, well eventually we’ll catch up, we’ll get the technology out. Um, that, that never happened. And so you had folks that finally started to blow the whistle within the organization saying, look this, the emperor has no clothes. This doesn’t work. This is after enormous amount of funding had come in through private investors. You had a who’s who board of directors that had signed on. The impact though was enormous amount of threat of lead litigation against the people blowing the whistle at first until it nobody could figure out how to replicate what they are doing. And they finally determined that this was a scam, but the damage had already been done at that point.

Ross: So these are examples where when you say compliance is boring, there is a much of what the regulations that we deal with, uh, particularly in, in research come out of historical atrocities or situations that everyone would know or remember or be horrified if they didn’t know about it and society saying, look, we don’t want that to happen again. We want to say that there’s certain guard rails that we want in place. We want research to happen. We want new innovation, but not at the cost of people losing, uh, things that we all hold highly in our society. Basic things that we all take for granted, all have come out of historical events where the response to that was to create a new regulation. All of these things are from a regulatory background. 

Carrie: So what do you do when a company or our business, the compliance is not happening from the top? I’m thinking of the Harvey Weinstein situation, title nine compliance. 

Andy: One of the things that we learn in looking at compliance failure is that the failure could happen all up and down the chain. Uh, you have, you have a number of examples where the, the problem with the compliance function, uh, could be viewed as, uh, a problem with an over bearing overwhelming personality at an organization. You, you asked about Harvey Weinstein and, and the, uh, sexual abuse allegations that have come out of that operation. You have a real challenge, uh, in a compliance role where the bad behavior is coming from the very top of the organization. Uh, in fact, in that case, the whole organization was built around Weinstein’s personality and Weinstein’s contacts and nobody underneath him, even though they apparently were aware of the behavior and understood the behavior was inappropriate, uh, nobody was in a position to call the question.

And you know, we see this, uh, in, in a number of, uh, organizations where you have a personality dominating the culture of the organization. Uh, you have other examples, uh, often that we see in rapidly emerging, uh, companies often in the tech field. Uh, think about, uh, Facebook when it was growing its, its model, its motto when its early years was move fast and break things. So if you have a culture from a dominant personality in a company like that, who is as our business model, our culture is all about move fast and break things. You very often end up in scenarios where, uh, the company’s behavior or the organization’s behavior, um, is getting ahead of evolution in the laws and the regulations and resulting in, in instances of noncompliance.

Ross: Right. And I think that part of the interesting thing is what you find with many of these organizations that get themselves in trouble is that that culture of of noncompliance is not usually not unique to one area where you see that manifest, uh, in the issue that ultimately gets them in trouble, quote unquote. There’s often, once the investigation starts to go in and get into the operations of that organization, they’re finding that there are other types of bad behavior that are were also being done. They may be weren’t the one where the whistle was blown, but there is a lot of other areas that probably were just as egregious. It’s just no one had yet blown the whistle to say, look, these are problems as well.

Carrie: Join us next time as we continue our conversation about the field of regulatory compliance and how it is evolving.

Love this episode of The Greater Good? Please rate, review and subscribe to the podcast. As a new podcast, ratings and reviews are critical to our success. We’d also appreciate your feedback to ensure we are bringing you quality content and conversation. If you’d like to learn more about our guests, access show notes and find additional resources, visit https://umainecenter.org/greatergood. Thank you.

The information provided in this podcast by the University of Maine System acting through the University of Maine Graduate and Professional Center is for general educational and informational purposes only. The views and opinions expressed in this podcast are those of the authors and speakers and do not represent the official policy or position of the university.