If your firm is like most, you carefully crafted your code of ethics and conflict of interest policies to comply with SEC, FINRA, FCA, or other applicable regulations, and of course your own internal policies.
Inevitably, there will come a day when an employee incorrectly self-reports, fails to report an activity, or your compliance department learns through internal inspections or other means that a breach has occurred. Do you know what to do when a policy violation occurs? Are you prepared to act? Do you have a defined process?
Consequences Should Fit the Violation
In organizations that have not had a history of conflict of interest breaches or policy violations, there can be some uncertainty about what type of disciplinary action is warranted.
Your first step should be to look to the underlying policy itself. Where your policy prescribes a certain type of punishment for a certain violation, you know where to start. In most cases, however, the consequences of violating policies are shrouded in ambiguity, saying something to the effect of, “Violations may result in disciplinary action up to, and including, termination of employment.”
That ambiguity can actually be good, as it gives your compliance department the ability to mete out discipline that fits the crime. Termination may be the extreme in the case of an otherwise-compliant employee who inadvertently violates your gifts and gratuities policy, but it may be appropriate for an employee who took steps to conceal a personal investment or relationship that constitutes a material conflict of interest to your firm.
Similarly, you may want to impose different consequences for a first-time offender than you would for a third offense, depending on the nature of the offense.
Follow a Consistent Process
When you encounter your first conflict of interest violation, you may not have the comfort of a familiar process to follow. Whether you are dealing with your first violation or your fiftieth, these tips may help you address the matter:
1. Gather the Facts. When a potential breach or issue comes to light, there may be an inclination to jump on it right away. However, make sure you have all of the relevant details and information before imposing consequences. Drafting and sending the employee a targeted inquiry email or letter asking for their response, relevant documentation and any other information that can help you evaluate the situation may reveal mitigating factors you will want to consider in determining what actions are appropriate.
2. Document the Situation. It is also important to maintain a complete record of every potential issue, including how it was identified, what steps were taken to investigate the matter, all related communications, and the ultimate disposition.
3. Who needs to be notified? Does this issue get reported to Management? To the Board? Or to the employee’s supervisor? You want to have a clear communication plan. You also want to have buy-in from others within the firm.
4. Issue Resolution. Identifying and investigating potential issues are critical steps, but it’s important to follow through with some sort of resolution. Your inquiries may lead you to a determination that formal disciplinary action is not necessary. In that case, don’t make the mistake of simply closing the file! You should document your decision by communicating with the employee in question. This will allow you to show a paper trail to regulators if you are questioned. Perhaps more importantly, it shows your employees you took the matter seriously and are committed to enforcing your firm’s policies and procedures.
5. Consistency is Key. Finally, if a similar issue with a similar fact pattern comes up again in the future, be consistent in your resolution process. This can help you avoid claims of preferential or discriminatory treatment. If you believe a different course of action is warranted, document your reasoning.
Of course, the facts and circumstances behind every violation or issue will be different. So, understand that a certain amount of flexibility may be called for. However, for employees to take your policies seriously, there needs to be clear consequences to violating them.
Comply with Both the Letter and the Spirit of the Law
Your code of ethics and conflict of interest policies may be in place simply because the regulators say you need them. However, you should follow and enforce those policies because it’s the right thing to do. And you should make sure you have the support of Management.
When a breach or violation occurs, look to your policies for guidance, and implement disciplinary actions designed to address and correct the behavior.