Beyond the blind spots in compliance

Managing compliance is more important than ever, and more difficult than ever. There are a wider range of emerging risks, from changing regulations and increasing frequency of investigations. Expansion into emerging markets means local regulations and customs need to be managed and then there are the challenges of outsourcing and offshoring.

In response pharmaceutical and life sciences companies have invested substantial time and resources in building sophisticated compliance programmes. They continue to implement ever more robust protocols, extensive training and stricter controls but organisations are still paying greater penalties and fines than ever. GlaxoSmithKline PLC paid $3bn to settle investigations of off-label marketing and defrauding the Medicaid programme, exceeding the $2.3bn Pfizer paid in 2009 for illegal marketing activities. In response to a major regulatory failure, a top 10 pharma company reviewed its marketing licences and discovered that 99.6% of the licences in Europe were non-compliant.

It is clear the compliance measures companies have put in place are not truly tackling critical issue of why some individual employees within an organisation make the wrong choices.

The tough questions
Companies need to understand why people, even with the best of intentions, end up making poor decisions, ignore or flout the guidelines and take risks that can put the company out of operation. They also need to find out why employees do not report the misconduct they observe.

A recent survey by the Ethics Resource Centre (ERC) reports that 45% of U.S. employees surveyed said they had observed misconduct in the previous 12 months, but a third of them did not report it. According to the ERC, this represents 20 million missed opportunities to address a problem. The top reasons for not coming forward are the lack of trust and accountability, fear of retaliation and the belief that nothing will be done (Figure 1).

Many organisations can identify the broad reasons for non-compliant behaviours and for tolerance for wrongdoing or misconduct. However, they often do not look further into the subtle cognitive factors that influence such behaviours. Yet if they could identify those psychological drivers of non-compliance, they would be much better placed to create a values driven culture that would start to make a difference in reducing unethical behaviour.

Companies need to understand why people end up making poor decisions

The reasons for non-compliant behaviour lie in the behavioural mechanisms
To be truly effective in embedding a culture of compliance, it is essential to understand employees have less control of their needs and motives than they think. The decisions they make are not always based on a rational view of choices, but rather on deeper innate needs that subconsciously influence and filter how we see the world. Employees who feel honest can also feel pressured, by the company’s culture as well as by individual colleagues, into doing things they would not do in other circumstances. Many aspects of these unconscious motivations originate in external factors such as organisational culture and norms and it is these that need to be addressed.

According to David Gebler, thought leader in ethics, values, and culture, and a teacher at Suffolk University, there are three mental switches that under certain circumstances affect the decision making process by enabling self-deception, rationalisation and disengagement.

Self-deception: “I think it is okay to do this.”
Self-deception allows people to believe they are doing the right things even though, in other circumstances (or if done by other people) they would judge it as wrong. Hersh Shefrin, professor of Finance at Santa Clara University, recently identified four types of self-deception that shape the way in which managers look at risk:

• Excessive optimism: viewing the world through rose-coloured glasses, overestimating the likelihood of favourable events and underestimating the likelihood of unfavourable events
• Over-confidence: overestimating our own knowledge and ability, including the ability to assess the risks we face. This is a particular risk for upper management as they become more disconnected from the day-to-day teams and don’t have an accurate view of the organisation, its operations and customers
• Aversion to a sure loss: tilting our decisions toward avoiding loss, even if it is not in our economic best interest to be so risk averse
• Confirmation biases: giving too much credence to evidence that confirms our views while dismissing evidence that contradicts our views.

Self-deception can also occur where there is a cultural difference in business norms. For example in some countries where business activities are relationship-based, a gift of gratitude is an acceptable practice. However requesting something in exchange for the gift, which would be deemed as a bribe, may be what the giver is implying. If an employee has an excessively optimistic or over-confident view then he may assume that the giver is being culturally appropriate within that local country’s market and that accepting the gift is not a problem.

Rationalisation: “I know it is wrong, but I have a good reason for doing it.” 
Under pressure to meet short-term goals, the right thing to do can seem wrong and the wrong thing can seem right. For example, a sales representative may justify the need to promote a drug for unapproved use in order to meet his sales target or to provide therapeutic benefit to patients. People find themselves in a position of weighing options, one of which has the best outcome but also the highest risk of breaking the rules.

This then leads to a situation where:

1. People know what they are doing is wrong, but they believe that they have no choice. 
2. People perceive that they are being treated unfairly, therefore they stop looking out for what is best for the organisation and focus only on what is best for them.
3. People face strong peer pressure and group conformity: “Everyone is doing this, and I am not going to be seen as an outlier or not a team player.”

Disengagement: “I know there is something wrong here, but it’s not my problem”, or, “Why should I bother trying to help? They won’t listen to what I say or appreciate what I do.”
Disengaged employees do not take ownership of problems and situations; rather they leave critical issues unresolved because they no longer care enough to make the effort to solve them. One of the prime drivers of this sense of disengagement is the feeling that the employee lacks autonomy.

This disengagement happens when management decisions are perceived to be counter to good compliance. The disengagement can start with actions that seem trivial but then builds up over time. As an example, using a raw material one day past it expiry, while not likely to pose any safety or production concerns, sends the message that the expiry dates is not firm. This message, combined with other similar decisions, discourage following the processes in general in favour of production. Shift a year later, the grace period could be expanded to 1 month or apply to finished product along with raw materials.

Understanding and tackling this disengagement is another way organisations can create a culture that discourages non-compliant behaviours.

Setting the stage for a compliance culture
Pharmaceutical and life sciences companies need to create strong social norms that dissuade self-deception, remove the sources of rationalisation and prevent disengagement. These then need to be integrated into the organisation’s everyday compliance training, communications and business processes.

This starts by the organisation understanding its current state of compliance. PA’s maturity model (Figure 3) highlights the key stages in the path towards compliance being culturally accepted. It is important to note that within an organisation, various functional areas may be at different points along the curve. There also needs to be recognition that moving to the upper part of the curve takes a longer time and real organisational commitment.

It is important to recognise that building a culture of compliance is not the same as being compliant

The journey in shifting to a positive compliance culture 
Getting to culturally accepted compliance means cultivating the desired behaviours. This means moving away from a mind-set of ‘tick box’ compliance. This should occur throughout each level of the maturity model by continuously assessing the current culture and identifying the obstacles that hinder compliant behaviours. This means instilling values, improving trust, and increasing employee engagement and involvement. Culture building is further facilitated by: open two-way dialogue at all levels of the organisation, mutual understanding and agreement of what is deemed compliant, and acknowledging that issues of non-compliance may arise.

David Gebler has developed a values-based framework for creating a high-performing corporate culture. This framework can be applied within the context of creating a positive compliance culture as well.

• Integrity: When managers demonstrate and demand consistency and predictability in their behaviours and how the organisation conducts its business, employees have fewer reasons to fall back on thinking only about their self-interest. Developing integrity is key to connecting an organisation’s standard of compliant behaviour (its proverbial ‘walk’) to its mission and goals (its ‘talk’). [Specific examples]
• Commitment: Compliant behaviours are tightly linked to an employee’s level of engagement and connectedness. Fostering an environment of active participation (and seeing the impact) makes it more likely for employees to take responsibility for their actions. They are also willing to be more proactive and contribute to the solutions. [Specific examples]
• Transparency: It is essential to create mechanisms to handle compliance issues to be raised, discussed, and resolved in a manner consistent with the organisation’s and employees’ values. Channels to ensure clarity in communication and assurances that the truth will be heard (and responded to) will permit employees to see whether their principles and beliefs are reflected in the organisation’s ethical standard of behaviour. [Specific examples]

Benefits of a positive compliance culture
It is important to recognise that building a culture of compliance is not the same as being compliant. Compliance activities are imposed on the organisation; culture is ingrained in the organisation.

In a positive compliance culture, employees and managers understand why doing the right thing is important for the organisation’s long-term viability, and they have the determination, courage and freedom to see that the right thing gets done. Meanwhile, leadership and managers are always on the lookout and responding to the mental switches of self-deception, rationalisation, and disengagement. This culture supports individuals to overcome personal obstacles and encourage independent thinking.

This kind of approach requires constant attention and focus from the top but, companies that get it right will create a sustainable culture of compliance where employees know what to do and why they should do it. Understanding and responding to the psychology of employees in this way means pharmaceutical companies will finally be able to reduce non-compliance and with it the reputations and financial damage they have seen in recent years.