UPI Study › Courses › Foundations of Leadership › Free lessons › Lesson 9.6 Free with a free account
Compliance, Integrity and Organisational Ethics in Practice
Foundations of Leadership · Chapter 9: Core ModuleSection 9.6 · lesson 64 of 9014 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Foundations of Leadership.
Lesson complete
Earn the 3 college credits for Foundations of Leadership
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: The Weight of the Armband →← What Makes People Tick at Work: The Science of MotivationNext lesson: The Weight of the Armband →
In this lesson
The architecture that turns a stated principle into reliable institutional behaviour.
- Distinguish compliance-based from integrity-based programmes
- Name the seven elements of an effective programme
- Explain internal controls, risk targeting and reporting channels
- Trace the maturity stages of an ethical culture
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,774 words). Read along, or search it.
Core Module
Compliance, Integrity and Organisational Ethics
This module has covered ethical frameworks, social responsibility, diversity, regulation and motivation. This section answers the question that ties them together. What does an organisation actually do, day in and day out, to turn ethical principle into reliable behaviour? The answer is unglamorous. Compliance programmes, internal controls, reporting channels, ethics officers, culture. Two broad approaches contend for primacy, and we will look at both. One focuses on rules. The other focuses on values. The consensus is that mature organisations need both, and we will see exactly why. Then we will look at why programmes with identical architecture produce completely different results.
Two Approaches
Rules or Values, and Why Neither Alone Works
Lynn Sharp Paine drew the clearest version of this distinction in nineteen ninety-four. Compliance-based programmes treat ethics primarily as adherence to legal and regulatory rules. The architecture is familiar. A code of conduct, a compliance function, training, monitoring, reporting channels and discipline. Their strength is clarity and defensibility. The rules are explicit, the controls auditable, the penalties predictable. Their limitation is that they tend to define ethics down to the floor of legal obligation. Which fosters a culture of what can we get away with, rather than what ought we to do. Integrity-based programmes treat ethics as the expression of shared values instead. They rely on senior leadership behaviour, internalised norms, peer accountability, and professional identity. Their strength is that they reach the vast range of questions no rule could anticipate. And the conduct they produce is robust to changes in monitoring and enforcement. Their limitation is that they are harder to scale, harder to verify externally, and harder to defend when something goes wrong. So almost every serious programme combines the two. Rules supply the floor. Values make the floor stick.
Seven Elements
The Global Structural Template
The structural template for modern compliance programmes has an origin most people find surprising. It comes from the United States Federal Sentencing Guidelines, of nineteen ninety-one, substantially amended in two thousand and four. The Guidelines set out what a programme must contain to count as effective, for the purpose of reducing a sentence. Seven elements, and they have become the global reference standard. First, standards and procedures reasonably capable of preventing and detecting criminal conduct. Second, high-level oversight. The board or senior management owns the programme's design and operation. Third, due care in delegation. No substantial authority to people the organisation knew, or should have known, were prone to misconduct. Fourth, effective training and communication, reaching all employees and relevant third parties. Fifth, monitoring, auditing, and evaluation of whether the programme actually works. Sixth, consistent enforcement, through both disciplinary mechanisms and reward systems. And seventh, response and improvement after detected misconduct, with reasonable steps to prevent recurrence. Those seven now appear, with local variation, from Brazil's anti-corruption law to United Kingdom bribery guidance.
Internal Controls
Five Components That Make Policy Operational
Compliance programmes rest on internal controls. The procedural mechanisms that ensure policies are actually followed in practice. The COSO Internal Control framework, from nineteen ninety-two and revised in twenty thirteen, is the standard articulation. It identifies five integrated components. The control environment is the tone, the values and the structures within which control operates. Risk assessment is the identification and analysis of risks to achieving objectives. Control activities are the specific policies and procedures designed to address those risks. Information and communication is the flow of information needed to support control. And monitoring activities are the ongoing evaluation of whether controls operate as intended. Notice that the first component is cultural, not procedural. That ordering is deliberate. The framework is now the structural reference for financial-reporting controls under regimes such as Sarbanes-Oxley.
Risk Targeting
Uniform Effort Is Mis-Targeted Effort
Risk management extends this beyond compliance, in standards like ISO thirty-one thousand. And in the COSO enterprise risk management framework. It covers the full range of risks an organisation faces. Strategic, operational, financial and reputational. For ethics in practice, the risk discipline matters for one specific reason. It forces the organisation to say where failures are actually likely. Which roles, which processes, which jurisdictions, which transactions. Then to estimate the likelihood and impact of each. And to design controls proportionate to the assessed risk. That sounds obvious, and most programmes do not do it. Programmes that distribute compliance effort uniformly over-control low-risk areas, and under-control high-risk ones. Targeted programmes perform better, at lower cost. Even effort is not the same as fair effort.
Reporting Channels
The Control System That Catches What Controls Miss
No internal control system catches everything. Some of the most serious failures in corporate history were not caught by controls at all. They were identified by employees willing to raise a concern. Which is why reporting systems have become a defining feature of modern programmes. The structural elements are reasonably standard. Multiple channels. Line management, ethics committees, ombudspersons, anonymous hotlines, and regulator-facing routes. Protection against retaliation for reports made in good faith. Clear procedures for investigation. And feedback to the reporter on what happened to their concern, which is the element most often skipped. The legal scaffolding has thickened substantially in the past two decades. Sarbanes-Oxley and Dodd-Frank, the European Union whistleblower directive, and the United Kingdom's public interest disclosure act. Several of them now provide statutory protection, and in some cases financial incentives for reporting.
Why Silence
Identical Architecture, Opposite Results
Here is the finding that should change how you read a compliance report. What separates programmes that work from programmes that exist on paper is largely cultural. Two firms can have identical formal architecture and completely different reporting rates. Employees report concerns when they believe the report will be taken seriously. When they trust the confidentiality of the process. When they have seen consequences actually follow the issues raised. When they have seen visible protection for people who reported before them. And when senior leaders model the receptivity they are asking of everyone else. Programmes missing any one of those conditions deliver low reporting rates. And here is the part that gets misread constantly, usually by boards. Low reporting is almost never evidence of low misconduct. It usually means the channel is broken, and the early-warning system has gone quiet.
Failure Modes
Five Recurring Causes
Surveys of major ethics failures keep finding the same five causes. First, tone at the top. Senior leaders who treat compliance as a check-box exercise produce organisations that do the same. Second, misaligned incentives. When the reward system pulls toward revenue regardless of the means used to get it, no programme can compensate. Third, captive monitoring. When the compliance function reports to operational leaders who have an interest in no issues being raised, independence is gone. Fourth, retaliation tolerance. When reporters are sidelined or punished in any form, reporting collapses. Fifth, improvement neglect. Issues investigated and closed, without revising the underlying systems, recur reliably. So the seven elements describe a programme that can work. These five conditions decide whether it does.
Institutional Seat
Ethics Officers and Board Committees
Most large organisations now have a designated ethics officer, or chief compliance officer. Reporting at senior level, and often directly to the board's audit or risk committee. Over three decades this has become a distinct profession. With its own associations, certification regimes, and growing legal status. The officer designs and operates the programme, and reports periodically to the board. They are the senior point of contact for ethics issues across the organisation, and handle regulator liaison. Board-level ethics or compliance committees are increasingly required, or chosen where the risk is material. They approve the programme, review its operation, and receive reports on significant incidents. And they check that the compliance function has adequate resources, independence and authority. That is a substantial change from the historical position, where compliance was delegated to legal counsel. Whether the institutional recognition translates into substantive influence is another question, and it varies a great deal.
Maturity
Five Stages, and Most Organisations Stall
The ethical culture maturity model borrows from parallel frameworks in safety, quality and risk. It describes a journey through five recognisable stages. At the ad-hoc stage, there is no formal programme, and issues are addressed only when the organisation is forced to. At the reactive stage, the organisation responds after incidents, but does not anticipate them. At the compliant stage, it meets external requirements. That is the floor, and no more. At the managed stage, ethics enters business decisions as a normal consideration. And at the embedded stage, ethical conduct is the cultural default. It renews itself across leadership transitions and business cycles, which is the real test. The progression is not automatic, and many organisations get stuck at compliant or managed. The transition to an embedded culture is rare, and fragile. It is far more easily lost than achieved. A single leadership change, a restructuring, or a long period of performance pressure can pull it back down the ladder.
Sustaining
What the Long-Stable Cases Have in Common
So what do the long-stable organisations have in common? Four features recur. Visible leadership behaviour comes first. Leaders who demonstrate the conduct the programme asks of others, including when it costs them. No statement of policy replicates that. Second, aligned incentives. Reward systems that count ethical conduct as a criterion of performance. And that decline to reward results obtained by means that breach the standards. Third, psychological safety, where raising concerns is normal and protected. Fourth, continuous learning. Incidents and near-misses examined seriously, lessons shared, systems revised. One bank shows what the combination costs, and what it buys. After conduct scandals costing several billion dollars in fines, it overhauled the formal architecture. The ethics officer went onto the executive committee, and compliance was made independent of the business lines. But the deeper change was conduct. Senior leaders publicly examined the decisions behind the failures. Performance management was revised so that conduct could limit or eliminate bonuses, regardless of revenue. Anonymous reporting rose threefold over four years, while the proportion of substantive reports stayed roughly constant. It means the increase was genuine concerns being raised, not noise. Material conduct incidents declined over the same period.
Consolidate
Five Questions to Ask of Any Programme
Finish with five questions you can put to any ethics programme, including your own. Is the programme owned at the right level? Programmes reporting below the board, or below the chief executive, struggle to influence the decisions that matter. Are the incentives aligned with the standards? Where the reward system pulls against the rules, the rules lose. Every time. Are the reporting channels actually used? Low reporting almost never means low misconduct. It usually means broken channels. Are issues followed by changes? Investigations that close without revising the underlying system guarantee recurrence. And do senior leaders model the standards? Tone at the top is read far more carefully than any policy document. A programme that scores well on all five is structurally and culturally sound. Score poorly on any one, and formal architecture will not offset it. Which is the argument of the whole module. These are not separate domains. Ethics, responsibility, diversity, regulation, motivation and compliance are dimensions of one commitment.
About Foundations of Leadership at UPI Study
Foundations of Leadership (Business 205) is a self-paced online course of 90 video lessons in 12 chapters, from the roots of leadership theory and the trait, situational and transformational approaches to power, decision-making, communication, teams, conflict, diversity and global leadership. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Business courses Every course with PRO →
Compare: Management and leadership courses · Foundations of Leadership vs Leadership and OB
Why take it here
Why students take Foundations of Leadership with UPI Study
Where the credit goes
Universities that work with NCCRS
Foundations of Leadership carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About Compliance, Integrity and Organisational Ethics in Practice
What is the difference between compliance-based and integrity-based ethics programs?
What are the seven elements of an effective compliance program?
What are the five components of the COSO internal control framework?
Does a low number of ethics reports mean there is little misconduct?
About the Foundations of Leadership course
How many college credits is Foundations of Leadership?
How much does Foundations of Leadership cost and what is included?
Which universities accept UPI Study credits?
How long does Foundations of Leadership take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Foundations of Leadership.
90 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →