Day 31 - Leveraging Root Cause Analysis for Effective Compliance
·8 min
This episode is the final installment of Tom Fox's daily January series '31 Days to a More Effective Compliance Program.' Fox begins by promoting his book, the 'Compliance Handbook, Fifth Edition,' published by LexisNexis, which provides year-long guidance with three key takeaways per entry. The core topic is using root cause analysis for remediation in compliance programs. Fox references the DOJ's Evaluation of Corporate Compliance Programs (ECCP), which states that a hallmark of an effective program is conducting a thoughtful root cause analysis and timely remediation. He details regulatory expectations, including demonstrating recognition of misconduct seriousness, accepting responsibility, and implementing measures to reduce future risks. A key practical question addressed is who should perform the remediation—whether the original investigative team or others, emphasizing the need for independence and objectivity. Fox advises Chief Compliance Officers to ask specific diagnostic questions after a problem, such as whether approvals were given, harm occurred, or systems failed due to workload or misunderstanding. He stresses that integrating root cause analysis findings into solutions is critical, and failure to remediate internal control gaps can lead to repeated misconduct, damaging regulatory credibility. Fox notes that both the DOJ's Corporate Enforcement Policy and SEC statements focus on steps taken upon learning of misconduct, including stopping it and adopting new controls. The process should involve using existing organizational data to develop logical, repeatable solutions that address root causes rather than symptoms. Fox connects this to the DOJ's broader goals under the ECCP, urging professionals to consider their program's structure relative to company risk. He cites the SAP FCPA enforcement action as a recent example where the DOJ commended SAP for performing root cause analysis and building remediation. Fox concludes with three key takeaways: objectivity and independence in analysis, using developed information effectively, and implementing data-driven solutions. He encourages listeners to check his book for more details on the series topics.
