What makes a successful Chief Compliance Officer?

Today’s papers are highlighting another case of data hacking: “News and entertainment giant ABS-CBN took down two of its online shopping sites on Wednesday, confirming reports they were hacked and that customer payment data might have been breached”.

It appears that personal information and credit cards were intercepted while people shop for merchandise for one of the 90+ television shows. The stolen data was sent onwards to a server registered in Irkutsk, Russia. The credit cards and identities are then (presumably) sold on the black market.

This and previous data breaches raise the issue of the need to have Chief Compliance Officers (COO) in your organization and to debate what it takes to make a successful CCO.

After all, much of the work they do is broadly similar to the work you do as an executive of an organization: they assess and remediate risk. What’s more, the audit profession has conducted many studies (much more than the compliance profession, frankly) to identify the skills that make a good audit executive. So what conclusions about professional success in that field might also apply to ours?

Well, audit executives have said for years that their most crucial skills are critical thinking, business acumen, and communication skills.

That answer would resonate with most compliance officers, too. Success isn’t necessarily about having a law degree, or advanced knowledge of software, or superior statistical analysis skills, although all those things help. Knowing how to work with other people to achieve compliance goals in a business process and understanding that the risk of data breaches is centered in the operations of an organization are essential traits of a successful CCO.

Let’s take “knowing how to work with other people” first. That really means success as a compliance officer is about persuasion. Many times I’ve heard compliance officers wish for a world where other parts of the enterprise pull compliance into the discussion about the business, rather than compliance pushing its way in. That requires persuasive ability.

Sure, executive support and independence of the compliance function help, but those things still just make the compliance officer a person to be respected or even feared. That’s not the same as a person who is welcomed. A successful chief compliance officer knows how to communicate and win enthusiasm from others regardless of whatever authority and independence you might have.

And to achieve compliance goals in a business process requires skill at risk assessment and design of internal controls, plus knowledge of how the business works. Those skills help to build a compliance function that prevents misconduct — and the more you understand the business, the better your compliance function can fulfill that goal at least cost.

A successful compliance officer knows how to weave him- or herself into those decisions. The more persuasive you are, and the more astutely you can embed compliance objectives into business processes, the greater a role compliance can play in those strategic and operational decisions.

That’s what success looks like. Budgets, autonomy, executive support, technology — they all help, to be sure. But let’s never forget what corporate ethics and compliance are about: persuading people to do the right thing. Ethics and compliance is, fundamentally, a people business. And if we say ‘people’, we mean people within the organization from top to bottom. Limiting the data privacy protection and cyber security debate to the C-Level only, is a big mistake, as said above, the breaches happen on the operational level.

Comments are welcome and assistance can be made available – contact [email protected]