Risk assessment: law, economics, morality science…and liquor
[This essay was originally posted on the Conflict of Interest Blog]
Many years ago a client who was in the compliance department of a pharma company told me his strategy for conducting risk assessments. He would schedule the interviews of sales people – a key, but typically difficult, constituency for nearly any risk assessment – to begin late in the work day, and after a while suggest that the discussion continue in a nearby bar. As the drinks began to flow, so apparently did the information about risks.
Risk assessment is the foundation of an effective C&E program – certainly as a matter of common managerial sense, and increasingly as a matter of law. In connection with the latter, we recently passed the ten-year anniversary of the revised Sentencing Guidelines, which established risk assessment as an official C&E program expectation of the U.S. government; and on virtually the same day, the Italian government published important new competition law compliance guidelines, discussed in this publication from the Baker & McKenzie law firm, which include a risk assessment component.
Still, meeting such expectations – by getting business people people to talk openly about the uncomfortable topic of risk – is as challenging as is anything in the C&E field. So, what can you use to make these conversations succeed if, like most C&E professionals, your toolkit doesn’t include a liquor cabinet?
Part of the way for dealing with this challenge is to provide that the assessment is conducted under the company’s attorney-client privilege and, beyond this, that no attribution to the sources of information will be included in the assessment report. These are the tools of law, and deploying them can be essential to success in a risk assessment. But offering confidentiality alone may not be enough because while it is typically in the clear interest of a company to have a thorough risk assessment, individuals’ interests often seem (and sometimes are) out of alignment with those of the organization. This is the realm of the economics-based concept of moral hazard, discussed in various prior posts of this blog that are collected here.
There is no panacea for dealing with this impediment – but hopefully one can make a persuasive appeal to an interviewee’s being a “C&E leader,” a formulation which seeks to blend considerations of personal and organizational benefit, to get the interviewee to be truly helpful for the risk assessment. Of course, for an approach such as this to work, it cannot be limited to the risk assessment process. Senior executives, and even the board of directors, need make clear through various intangible and occasionally tangible ways that such leadership is duly appreciated.
Finally, there is also a psychological dimension to the challenge of risk assessment. As discussed in this recent article in Science – “Morality beyond the lab” by Jesse Graham (which I learned of from the Ethics Unwrapped web site ), various “laboratory studies have shown a ‘holier-than-thou’ effect, in which people over-optimistically predict their own future moral behavior but accurately predict the not-so-moral future behavior of others” – a view which has now been supported by the results of an important recent field study (by W. Hofmann, D. C. Wisneski, M. J. Brandt, L. J. Skitka, which is published in the same issue of Science). As summarized by Graham: “[T]he study suggests that moral life can largely be characterized by two kinds of events: noting one’s own good deeds and gossiping about the bad deeds of others.”
For those conducting risk assessments, the path suggested by this research is clear: to the maximum degree possible, one should structure the inquiry so that it is not seen as asking about the interviewee’s own risks but those of others. And, in providing information about others, at least in the aggregate, employees of an organization will likely be helping you analyze risks that in fact involve themselves.
One other point about the above-discussed research, which is that while I have highlighted its use for risk assessment there are other ways in which this aspect of what Graham calls “morality science” can enhance the efficacy of a C&E program. Mostly notably, it can be used in training and other communications to underscore the overarching behavioral ethics notion that “we are not as ethical as we think,” which should help reinforce an appreciation for the help that C&E staff and other resources can provide to employees when confronted with legal risks or ethical dilemmas.
For further reading on risk assessment, here’s a link to a complimentary e-book comprised mostly of my risk assessment columns in Corporate Compliance Insights.
For an index of posts on “behavioral ethics and compliance” please click here.
