Enhancing Compliance: Investigating Misconduct and Root Cause Analysis

A truly effective compliance program must possess a well-functioning and adequately funded mechanism for timely and thorough investigations into any alleged or suspected misconduct by the company, its employees, or agents. However, according to an article from All Things Compliance, a robust compliance program should go beyond addressing specific incidents and integrate lessons learned from misconduct into its policies, training, and controls to prevent future breaches.

The guidance from the 2020 FCPA Resource Guide, 2nd edition advocates for a post-investigation root cause analysis to identify the underlying reasons for misconduct, and the 2023 ECCP further emphasizes this by posing questions related to the company’s root cause analysis of the misconduct, identification of systemic issues, and involvement of key personnel in the analysis.

Fraud investigator Jonathan Marks underscores the importance of a root cause analysis, defining it as a research-based approach to identifying the fundamental reason behind a problem. He distinguishes it from a risk assessment, noting that it focuses on previously identified issues. Marks suggests various methods, including the Health COMPass four-step process and the Five Why’s approach borrowed from Six Sigma. The latter involves repeatedly asking “Why” to peel away layers of symptoms until reaching the root cause.

However, Marks highlights the need for trained professionals with an operational understanding of business operations to conduct effective root cause analyses. It’s not just about asking questions but requires expertise to delve into the intricacies of a company’s functioning. Overall, the emphasis is on a comprehensive compliance program that not only investigates misconduct but also learns from it to implement preventive measures through thorough root cause analyses.