Ann Arbor, Michigan - Corporate ethics compliance programs have flourished since the federal government gave companies that established one a break on fines and penalties in 1991.

Corporate scandals also have continued unabated. A new analysis by University of Michigan researcher David Hess suggests that both companies and the government rely too heavily on merely having a compliance program—and not enough on preventing bad behavior.

Hess recommends two key additions to federal corporate sentencing guidelines that could help companies achieve an ethical culture, not just a system of legal compliance.

"It's really easy to focus on things that can be measured—like how many employees received compliance training or how many audits we did—and say the job is being done," said Hess, associate professor of business law at U-M's Ross School of Business.

"But to really have an ethical infrastructure you need the right culture, and that's not easy to measure. So over time, compliance and culture became these two separate things when they're really two sides of the same coin."

Current government guidelines and the way they're adopted by companies create too many "paper" compliance programs with no real teeth, he said. They also bring criticism from those who think it lets companies off the hook too easily, and from those who say it doesn't give companies enough credit for the work they do to create these programs.

The government lays out seven requirements:

• The corporation must establish standards and procedures designed to reduce the risk of criminal conduct.
• The compliance program must be overseen by high-level personnel.
• The corporation should not grant substantial discretionary authority to any individual who has a propensity to engage in criminal conduct.
• The organization's standards and procedures must be communicated to all
• employees.
• The corporation must enforce its program, and may ensure compliance with its standards and procedures through monitoring and auditing systems, and means for employees to report wrongdoing without risk of retribution.
• The organization must consistently enforce its standards.
• Any violation of the program should be followed with appropriate disciplinary action and updating of the program as necessary.

To that, Hess would add:

• Monitor the organization's informal system of communication, surveillance and sanctions, and promote an informal system that supports the goals of the compliance and ethics program.
• Periodically assess organizational members' perception of the organization's ethical climate.

This gives some structure and meaning to the idea of culture, Hess said. It connects the formal system, the compliance program, to the softer, informal system—group pressures and ethical norms at the local level. The two should not be treated separately.

"The managerial part of this is just as important as the legal part," he said. "The goal isn't simply to prevent a bad person from doing a bad thing, but to ensure the company isn't pushing a good person into doing a bad thing, and to create a culture that helps people do the right thing."