Note: Part 1 of this series, “Selecting a Corporate Monitor”, covered the selection process for monitors and independent consultants and the criteria companies should use to help identify which monitor would most closely meet their needs.1International Banker: “Selecting a Corporate Monitor,” John P. Carey, June 11, 2021. This article covers the monitoring process itself and how to ensure the best possible outcome. It assumes a monitor is now in place and agreement has been reached on the terms of 1) the enforcement agreement between the government and the company, 2) the engagement letter between the company and the monitor (and government, if required) and 3) the scope of the work to be performed under the monitorship.2For more information about issues related to the enforcement agreement, the engagement letter and the scope of work, see Law Business Research, “The Guide to Monitorships, The Life Cycle of a Monitorship”, Thomas J. Perrelli , 2019.
See also IAICM: International Association of Independent Corporate Monitors: Code of Conduct.
Issues concerning the budget and the general scope of work have been resolved, and the monitorship is underway.
Corporate monitorships are currently on the rise, and any company in this position faces an enormous burden. Driving the monitorship process to a successful conclusion requires proper preparation and planning, ongoing engagement and transparency, and careful alignment between the monitor and the company on the facts at hand.
Preparation and planning
As with anything, good advance planning and structure will help the engagement start on the right foot. Getting the monitor team fully acclimated and prepared will only lead to a better result.
Educate the monitor about the company.
Even before work begins on the development of the work plan, it is important that the monitor team understand the company, its primary businesses, the industry in which it operates and the competitive landscape. A thorough understanding of the marketplace, how the company acquires and retains customers, and what drives revenue and earns income will provide solid grounding. The monitor team needs to understand the company’s major competitors, maturity of the industry in which it competes and product sets it offers to appreciate the business paradigm in which the company operates. Finally, educating the monitor on the system of internal controls at the outset of the engagement will help minimize surprises on both sides.
Continue orienting the monitor team by presenting an extensive primer regarding the company’s overall governance, board oversight and management structure. This includes understanding board and management committees, board and management reporting, and other tools used by the company to run and manage the business. Establishing monitor team meetings with each member of the senior leadership team and department head will also provide a better understanding of how the company operates on a daily basis. A vital early step is a meeting with appropriate members of the board of directors, including all members of the committee charged with the oversight of the enforcement agreement.
Set expectations to build trust.
Set expectations within the company right from the start, specifically with those likely to interact with the monitor team directly. Insistence on transparency and candor from all who work with the monitor team is necessary for success, as is providing knowledgeable and appropriate subject-matter experts. One can never overstate the importance of building trust—for both sides. It is critical to avoiding unnecessary contentiousness and acrimony. Respectful disagreements will occur, but in most cases, they can be resolved when there is appropriate trust and respect.
Establish communication lines, starting at the top.
There should be a standard cadence of communications. Standing meetings with the monitor-team leadership and the appropriate company leadership will ensure that communication lines always remain open. Appropriate areas of discussion include the status of document and information requests, areas of focus, changes in relevant and key personnel, relevant developments occurring at the company, planned travel, budget-related matters and potential areas of concern. Understanding and agreeing to standard reporting from both parties will help ensure appropriate and continued alignment.
Engagement at the top of the house will help the company significantly as it works through the burden of a monitorship. To that end, also be sure that the board of directors or the appropriate board committee meets regularly with the monitor and that the monitor knows that he/she has access to both senior management and the board when necessary. Further, agree on a protocol for escalating and resolving disagreements between members of the monitor team and their company counterparts.
Create a process for protecting and managing proprietary information.
Establish rules of the road for handling, protecting and managing proprietary and confidential information early in the engagement. If vendors or other third parties are typically required to take necessary training, be sure that the monitor team meets those requirements as well. If individual confidentiality agreements are appropriate, put those in place before members of the monitor team have access to sensitive information. Quickly establishing the protocols for transferring information and system access, where needed, will also reduce costs and other burdens on the company. For example, designated representatives from the monitor team could centralize requests for documents, while designated representatives from the company ensure timely delivery. Consider establishing service level agreements (SLAs) for document production and responses to meeting requests.
Manage the work.
As you prepare for the monitorship’s work, request that the monitor provide a list of all those who will work on the engagement and their roles and responsibilities. Ask that the monitor supply bios that detail each individual’s qualifications, expertise and background. Gain an understanding from the monitor that if there are changes to the personnel who serve on the monitor team, those changes will be communicated to the company before any new member begins to work on the engagement.
If the monitorship is broad in scope, consider asking the monitor to establish separate workstreams so that all required areas of inquiry are fully prepared and covered. To avoid scope creep, be sure to understand the specifics of each area to be covered and why. Workstreams can be organized by lines of business and operating areas, the three lines of defense, the pillars of compliance or a combination of all. Establishing designated workstream leads from the monitor team, coupled with company counterparts, will help improve efficacy, trust and efficiency. Further, where a monitorship is complex or far-reaching, establishing a project-management office with a designated counterpart from the monitor team may prove useful in managing the engagement.
Regardless of whether the enforcement order requires developing a work plan, it is reasonable to ask the monitor team to present a detailed plan for how it intends to undertake the engagement. The company should provide input and react to the overall plan. If some areas are unclear, resolve those issues before too much time passes. If there are questions or concerns about scope, try to resolve those issues early. Issues about appropriate scope are common in monitorships. Working to resolve them early will help avoid future disconnects. Once the work plan is agreed on, it can serve as a guidepost when questions about lines of inquiry, relevance or scope arise between the monitor and the company.
Know what success looks like.
Understanding what success looks like is an important threshold to establish. Typically, the enforcement agreement will define the standard that the monitor must apply when assessing whether the company has met its obligations. Language such as “reasonably designed and implemented” is often the standard used by the monitor when assessing the company’s program. Be sure that the work plan specifically incorporates the standard found in the enforcement agreement. Further, consider developing a detailed target operating model that will last well beyond the monitorship and reflects sustainability—and share that vision.
Ongoing engagement and transparency
Once the appropriate preparation and planning are in place, be sure that ongoing engagement and transparency continue throughout the life of the monitorship. The company must respect that the monitor will have separate communications with the government. However, if the monitor has regular meetings with government supervisors, arrange to meet frequently in advance to ensure the factual accuracy of any reporting.
Make and keep standing meetings.
As noted above, establishing a set of standing meetings at various company levels, such as board members, senior executives, compliance leaders, internal and external counsel, and other impacted areas of the company will help avoid disconnects and allow for early escalation of any issues. Building strong communications in both directions will benefit all parties. Some companies appoint a relationship manager for the monitorship, similar to a regulatory relationship-management role at a large financial institution. Having a single point of contact and a resource for the monitor team will keep communications on track.
Use every avenue available before escalating issues to the government.
When disagreements arise, having the right people engaged in these issues is important. Senior-leadership engagement with both the company and the monitor team can help narrow differences and de-escalate issues. Whether the issues relate to personnel, fees and expenses, scope or relevance, both parties must work to close these issues and resolve them appropriately. Neither the monitor nor the company wants any disagreement to spin out of control, requiring the government’s involvement to resolve. Use the protocols established early in the engagement and examine the source documents—such as the enforcement agreement, stipulated facts and engagement letter—for guidance and intent.
Provide full transparency.
With respect to the self-disclosure of regulatory breaches, challenges, missteps or operational failures discovered through self-testing, customer complaints or internal-audit findings, providing full transparency will go a long way in maintaining trust between the monitor team and the company. Even when all the facts are not fully known, offering an early briefing on the issue, with a pledge to obtain all the facts and background, will provide confidence to the monitor that the company is committed to addressing any gaps in the program. The worst possible outcome would be failing to disclose a known gap, the monitor team subsequently discovering that gap and then having the issue morph from being a breakdown in controls or compliance failure to a failure in transparency and ultimately trust.
Transparency isn’t limited to disclosing issues or control failures; it applies to all relevant and material changes in the company. Where there is a planned change in strategy that may affect the operations under the review of the monitorship, leaning forward and offering briefings on the change will help keep the monitor team fully informed, building on that needed trust between the monitor and the company.
Keep in mind the rule of no surprises; it builds trust and will help ensure success as the company works through the monitorship.
Navigating findings and executing remediation
Often monitorships are multi-year engagements during which the monitor issues reports to the government and the company, noting the status of the company’s compliance and oversight program. These reports will generally contain findings and conclusions that the monitor team has reached through its work. While the company must respect the monitor’s independence, how he/she arrives at those conclusions is an area where the company can and should participate actively.
Before the monitor arrives at any conclusions or findings, the monitor team and the company should agree on a process to validate preliminary conclusions. Ensuring that a potential underlying conclusion is factually accurate is important for both parties. The company should ensure that any potential finding is based on an agreed set of facts. Where there are potential disagreements about factual predicates, the company should provide the monitor team with objective data that supports the company’s view of the facts.
Once in agreement on the material facts, follow an agreed process through which the company can assert its view of the relevance, materiality, severity or context of the issue at hand. The decision on context or materiality is that of the monitor, but it is important for the monitor to hear from the company in order to appreciate the full background, mitigating factors and other considerations. Although the monitor is free to make that determination without driving agreement with the company on what are or are not significant issues, the monitor will benefit from the company’s perspective. Often companies fail to separate disagreements over factual accuracy from disagreements on the significance of the issues at stake. Be sure to make that separation. In short, the parties should ultimately agree on the facts but may often end up disagreeing on the significance of the issues identified.
With a multi-year monitorship, it is important for the company to develop an effective way of remediating any of the findings issued in the monitor’s reports. Two key points:
- In addressing a finding, be certain to identify the root cause of the breakdown or gap. Looking at the root cause will not only help the company address the specific issue identified by the monitor but may also help identify where there may be similar gaps within the organization. The monitor will look at whether the company has addressed the issue broadly and in a way that is sustainable, beyond the immediate issue identified.
- In a complex monitorship, where there are multiple findings of breakdowns or gaps, consider establishing an independent remediation office to oversee the remediation and validate internally and independently whether each finding has been fully addressed. Consider whether to engage the company’s internal audit function to support the independent validation of effective remediation. For each issue identified by the monitor, use a modified Responsible, Accountable, Consulted, Informed (RACI)3A RACI responsibility matrix is a project-management tool used to outline roles and responsibilities for completing tasks or deliverables for a project, particularly when it involves cross-functional projects or processes. RACI is an acronym that is derived from four key responsibilities: Who is Responsible for completing the actual work or assignment; who is Accountable for ensuring the work is, in fact, completed as required or designed; which people in the organization must be Consulted given their subject matter or domain experience; and who are the individuals who should be Informed on the status or the progress of the project. See also: Management Study Guide: “What is RACI Matrix – Rules for Using the Matrix”. responsibility assignment matrix. Assign a group of individuals who are Responsible for doing the work and implementing the corrective actions. Also, designate the executive who is ultimately Accountable for ensuring that the work is done right. Establishing clear ownership will drive the attention to detail needed to remediate any findings issued by the monitor effectively.
A successful monitorship outcome requires preparation and planning, expectation-setting, transparency, effective communications and interaction, and well-designed and sustainable remediation. Investing the time to put these drivers in place will redound to the benefit of the company.
References and additional notes
1 International Banker: “Selecting a Corporate Monitor,” John P. Carey, June 11, 2021.
2 For more information about issues related to the enforcement agreement, the engagement letter and the scope of work, see Law Business Research, “The Guide to Monitorships, The Life Cycle of a Monitorship”, Thomas J. Perrelli , 2019.
See also IAICM: International Association of Independent Corporate Monitors: Code of Conduct.
3 A RACI responsibility matrix is a project-management tool used to outline roles and responsibilities for completing tasks or deliverables for a project, particularly when it involves cross-functional projects or processes. RACI is an acronym that is derived from four key responsibilities: Who is Responsible for completing the actual work or assignment; who is Accountable for ensuring the work is, in fact, completed as required or designed; which people in the organization must be Consulted given their subject matter or domain experience; and who are the individuals who should be Informed on the status or the progress of the project. See also: Management Study Guide: “What is RACI Matrix – Rules for Using the Matrix”.