Compliance Incentives, Risk Assessment and Moral Hazard

Compliance Incentives, Risk Assessment and Moral Hazard

“Moral hazard” exists where there is a misalignment of incentives between those with a capacity to create risks and those likely to bear the costs of such risks. This is a broad concept and should not be limited to compliance and ethics (C&E). But C&E professionals need to understand moral hazard and deal with it using the tools of their trade.

More specifically, moral hazard presents significant specific challenges to promoting C&E. That is, the law (most notably US Justice Department policy) provides for large fines for organizations convicted of federal offenses, but also provides that those who bear the brunt of such punishment (mostly the shareholders) are often different from the individuals who benefit from the wrongdoing in question (usually the executives or other high-ranking personnel).

Substantively this is not generally an area of great legal exposure for companies. But it can lead to significant business exposure of various kinds.

What does this mean for C&E professionals?

First and foremost, risk assessment should include financial incentives of the sort (e.g., salary, bonus, etc.) likely to be reviewed by Justice.

Second, the risk assessment should include non-financial moral hazard incentives. This includes reputational benefits. This is obviously tricky but  keenly important, at least at some companies.

Third, key personnel should be trained on identifying and addressing moral hazard. Included here are HR, finance, risk. and various members of management.  This can be done as part of broader training.

Fourth, audit and C&E should develop procedures for assessing compliance in this area. Included here are questions in culture surveys.

Fifth, to the extent possible personnel evaluation should consider moral hazard risk. But for some companies this might be a bridge too far.

Indeed, generally I am not saying that all organizations need to engage in a full-fledged version of each of these steps. That would indeed be overkill for many.

But all organizations should at least consider generally what their moral hazard needs are and should respond appropriately.