Small Fries and New Guys Need Compliance Too

The recent compliance implosion at online benefits success story Zenefits (see Ben DiPietro’s excellent summary from the WSJ here) underlines a consistent misperception I’ve seen my whole career regarding who gets in trouble and why.  Many small businesses and startups seem to think the only organizations that get in trouble, and therefore need to seriously address their compliance risk, are the large multinationals that make up most of the media stories devoted to fraud, abuse and non-compliance.

As with a lot of commonly held perceptions, it’s not right.  In fact, the most serious repercussions for organizations are overwhelmingly meted out to small organizations. In the past five years 88% of organizations that ended up with federal conviction had less than 500 employees and 70% of those businesses had less than 50 employees (Source: US Sentencing Commission’s Interactive Sourcebook - isb.ussc.gov).

Smaller organizations in particular find themselves in the danger zone because they are less able to absorb the costs and lost business opportunities that come with a serious investigation – even if that investigation ends up with exoneration. And let’s not forget that in six out of ten cases where an organization is sentenced at least one individual is sentenced as well. Unlike the organization, the individual is apt to find himself in the penitentiary (Source: US Sentencing Commission’s Interactive Sourcebook - isb.ussc.gov).

Newer companies, especially ones that hope to one day go public, also need to consider having more than the “basic requirements” when it comes to compliance.  Reading about the culture at Zenefits one gets the sense that turning that ship around is going to be difficult and resource intensive.  Imagine how much easier it would be to save and grow that business if such a radical change weren’t necessary right now?  Many of us have seen dysfunctional organizations with, shall we say, “complicated” cultures.  And many of us have seen men and women of good will attempt to undo the effects of poisonous culture on morale, recruitment and retention, business focus and long-term strategy.  Sometimes the poison has seeped too far into the roots and the organization cannot survive. It’s a sad thing to witness. It’s made doubly sad because it is so avoidable.

New and small organizations are in a unique and enviable position with regard to real culture change compared to larger, more-established organizations. A smaller, nimbler ship can be more effectively turned and guided away from the shoals.  A newer organization, in particular, doesn’t have the historical baggage to weigh down their efforts to seed a positive, ethical culture.  And while tending those seeds now takes consistency and work, it’s nothing compared to the resources needed to turn around an organization infested with rot.

Smaller organizations aren’t necessarily expected to have compliance and ethics programs that are as mature and structured as larger organizations. The Sentencing Guidelines and periodic guidance from the Department of Justice and the SEC make that clear.  But all organizations, regardless of size, are expected to take a risk-based approach to construct and maintain an effective program and nurture an ethical culture.

Doing too little, or nothing, never ends well.