Month: March 2010

Compliance Bits and Pieces for March 5

Here are some compliance related stories from the past week:

Setting Off Alarm Bells at Work by Steven D. Levitt on Freakonomics

Apparently, the use of such internet sites [Facebook]  is not tolerated by CPS and rather than block those websites altogether, accessing them causes this ear-piercing noise to go off that sounds something like a fire-department wagon passing directly by you.

…

The firm gives the workers an incomplete list of which sites are banned.  Thus, the worker can never be quite sure when they go to a site that should be banned (but may or may not actually be alarmed due to the difficulty of identifying and banning every naughty site), if they will trigger the alarm.

CNBC Video: Madoff Whistleblower Speaks from Securities Docket

CNBC’s Mary Thompson’s interview with Harry Markopolos, the Madoff whistleblower who is now promoting a book on how he he tried to warn the SEC and others about Madoff’s Ponzi scheme.

The Depressing Tone of Bank of America by Matt Kelly of Compliance Week

Sometimes corporate leaders step up and do the simple, ethical thing, and their tone at the top is a harmonized chorus delightful to hear. Sometimes they do the wrong thing, and their tone is more like a tribal screech of self-interest.

Internal Review of a Proposed Foreign Business Partner by Thomas Fox

A Foreign Business Partner Review Committee should be established which is tasked with reviewing all the investigative due diligence and the Business Unit’s case for partnering with the person or entity. The next area of review should of the proposed Foreign Business Partner’s ethics and compliance program. Such a program should have, at a minimum, the following elements of a Foreign Corrupt Practices Act (FCPA)-style compliance program in place.

To Be or Not to Be Honest with the SEC by Suzanne Barlyn in the WSJ’s Financial Advisor

Weighing the risks and rewards of voluntarily reporting compliance lapses to the Securities and Exchange Commission is a tricky issue for investment advisers. Gene Gohlke, associate director of the SEC’s Office of Compliance Inspections and Examinations, recently tried to ease advisers’ concerns about self-reporting violations that their compliance programs catch, such as certain trading errors.

Wikis, Learning, Teaching and Compliance

wikipedia

I am a believer that the use of 2.0 tools can help compliance professionals. (Hopefully, this blog is a part of that proof.)

Moving to the inherently open communication of 2.0 tools from the inherently private channel communication of email can expose sunlight on behavior and expose information. Incorrect information and behavior can be corrected. Bad information and bad behavior can be seen and stopped before it snowballs into something larger.

I often hear people take the position that the digital youngsters coming out of college can use these Web 2.0 tools as easily as dialing a phone or that they are demanding them in the workplace. I don’t think that’s not true.

Law Schools and Wikis

Eric Goldman and Luis Villa shared their experiences in using wikis as part of their classrooms. It certainly sounds like their students struggled with using these tools, both behind the firewall and in the public Wikipedia.

In Mr. Goldman’s case he offered his law students the opportunity to publish an article in Wikipedia for 20% of their grade. About a quarter of the students in his cyberlaw class at Santa Clara University School of Law took him up on his offer.

In reaction to that article, Mr. Villa recounted his experience using a school-hosted wiki as part of his classes at Columbia Law School.

Other wiki concepts, like extensive linking, or publishing drafts to the world in wiki-style, were apparently even more strange to most of my classmates. None of the four class wikis were deeply interlinked or cross-referenced, outside of what was necessary to create a table of contents and occasional outlinks to wikipedia. Similarly, few students were willing to post works-in-progress to the wiki and refine them there- most students preferred to work privately and then put a final text into the wiki.

Collaboration Between Generations

I found the same to be true at my old law firm. In particular, the younger attorneys did not want interim drafts to be seen and were reluctant to contribute content. The more seasoned attorneys were more willing to edit and add information. The vast majority of article creation was limited to a small group.

In my view, younger team members are reluctant to produce content because they do not want to expose their lack of knowledge, they do not want to expose themselves for criticism and they have little grasp of the technology.

The lack of knowledge is true regardless of how you teach collaboration. It would seem silly to put the youngest members of the team in charge of the team’s knowledge and content production. They have the least understanding of the subject matter.

Dealing with Criticism

The criticism issue has two parts. On one side, I don’t think students are taught to collaborate. They go through school being graded on their individual performance. The few classes that grade as a team are outliers.

The second issue is the internal culture of  your company. Collaboration requires trust. You need to work as a team and avoid individual blame. It also requires sharing the credit for good work among the team. That is just how your company or group at the company operates. Technology does not change culture.

The Technology

As both Goldman and Villa point out, the technology is still a barrier. There are many inherent limitation in a wiki that you don’t have with Microsoft Word. I think the wiki markup language is a mistake. I think platforms should just use html based code.

Regardless of the underlying code, web-based documents do not have the rich formatting of Word. Arguably, you don’t need the vast majority of that formatting. It’s still very frustrating when something easy to do in Word is hard to do in a wiki.

Printing is another issue. In the end you may want to print hard copies. I have experienced widely different quality in what happens when a wiki page goes to the printer.

Wiki for One

I have to admit that I have not been preaching the benefits of 2.0 tools within my company. I use them purely as a knowledge tool for me. I use this blog and an internal wiki to store information for me to find as part of the compliance program. Most of the company is numbers driven, something for which web 2.0 tools are poorly suited.

I did collaborate with a summer intern on a compliance project using the wiki. I had the same experience as Goldman and Villa. Using a wiki did not come naturally to her. It took time for me to develop the trust for her to use it effectively.

In the end we worked together to create a tremendous amount of content for the compliance program that is well-organized and easy to find.

Other Examples

Over the last year I have seen an increase in the public use of Web 2.0 tools by compliance professionals. There has been a dramatic increase in the use of blogs. You can look at my blogroll for other examples.

One to take a close look at is Kathleen Edmond’s Blog. She publishes disciplinary examples from Best Buy. As you might expect, the examples do not include specific people or products. She is able to get the ethics story from Best Buy out into the public. She can get comments on her reasoning and the results.

Sources:

Madoff Losses Down from $65 Billion to $20 Billion

How do you value fraud?

When the Madoff ponzi scheme collapsed the claim was that there was $65 billion in losses. That was the total dollar value on the account statements given to investors. Of course, that number was fictional because there were not real assets behind those numbers.

The trustee overseeing the liquidation of the assets looked at the cash that came into Madoff and the cash that came out. The bankruptcy judge agreed. In a decision filed on Monday, Federal Bankruptcy Judge Burton R. Lifland ruled that losses should be defined as the difference between the cash paid into a Madoff account and the amount withdrawn before the fraud collapsed in mid-December 2008.

The Madoff trustee, Irving H. Picard, took the position that “the only verifiable amounts” reflected in the Madoff records are the differences between how much investors put into their accounts and how much they took out.

The result is that those investors who didn’t pull out their initial capital will get a greater percentage of their money out than those who took withdrawals from their accounts.

To put it another way, the people are getting the greatest percentage of money back are:

  1. Those who least need the money. Since they took less money out they presumably have other income or capital to support their needs.
  2. Those most trusting of Madoff.  Since they trusted Madoff, they did not pull money out of their investment accounts. They rode those returns and let their fictional returns keep accumulating.

Those who took out more cash from Madoff than they put in were labeled the “net winners” and get nothing. Even worse, it looks like the “net winners” may have to give back some of their “winnings” to the bankruptcy estate to pay off the net losers.

Of course, the opposite ruling is just as bad since the early investors would be paid by later investors, effectively extending the Ponzi scheme.

The judge is taking the position that people should be put back to their position as if they had not invested with Madoff. In the end its going to bad for all the investors. It’s just a question of who feels the most pain.

Sources:

Data breach Sharing Framework

verizon business logo

With the Massachusetts Data Privacy Law now in place (and presumably you are in compliance with it), you need to think about what to do if you have an incident.

Verizon has published the Verizon Incident Sharing Framework to help.

Our goal for our customers, friends, and anyone responsible for incident response, is to be able to create data sets that can be used and compared because of their commonality. Together, we can work to eliminate both equivocality and uncertainty, and help defend the organizations we serve.

The framework is set up to help classify incidents, their discovery, mitigation and impact.

Sources:

Data Breaches and Knowledge Management

One of the features of the new Massachusetts Data Privacy Law is that it forces some knowledge management on companies in the context of data breaches.

Since the law required compliance on or before March 1, 2010, I assume you already have the policy and safeguards in place. That is, if you have social security numbers or financial account information for any Massachusetts resident in your computer systems or files. Yes, the reaches beyond the borders of Massachusetts and is not limited to Massachusetts companies.

201 CMR 17.03(h) and (i) require regular monitoring of your program and a periodic  review of its scope.

201 CMR 17.03(j) goes on to require that you document any responsive actions, have a post-incident review and document any changes to your program after the review. That sounds a lot like knowledge management to me.

The Office of Consumer Affairs and Regulation has published a handy 201 CMR 17.00 Compliance Checklist (.pdf). You should also review and be familiar with the law itself contained in 201 CMR 17.00 Standards for the Protection of Personal Information (.pdf).

Image is by Darwinek in Wikimedia Commons: Flag Map of Massachusetts

Today is the Deadline for the Massachusetts Data Privacy Law

March 1 is the compliance deadline for the Massachusetts Data Privacy Law. 201 CMR 17.00 requires you to be in full compliance on or before January 1, 2009 January 1, 2010 March 1, 2010.

If your company receives, stores, maintains, processes or otherwise has access to “personal information” acquired in connection with employment or with the provision of goods or services to a Massachusetts resident you are subject to the requirements of .

If you have employees or customers in the Commonwealth of Massachusetts, then you are subject to this law. The law is not restricted to companies located in Massachusetts. But if you are located in Massachusetts then you have Massachusetts employees and their personal information, making you subject to the requirements of the law.

The law is a bit watered down since its initial form, but you still need to pay attention to it. There are some reasonableness standards in the requirements that make it easier to comply. You still need a policy, need to inventory your stores of “personal information” and educate your employees about the importance of safeguarding personal information.

The Office of Consumer Affairs and Regulation has published a handy 201 CMR 17.00 Compliance Checklist (.pdf).

You should also review and be familiar with the law itself contained in 201 CMR 17.00 Standards for the Protection of Personal Information (.pdf).

Since today is March 1, you still have a few hours to get things in place to be compliant with the law. If you haven’t done taken the proper steps, stop reading and go do it.

Previous Posts: