The role of discipline in effective compliance: survey results from the Nordics

The latest edition of the Nordic Business Ethics (NBE) Survey focused on understanding what makes a compliance program effective. A major theme that emerged from the results was the impact of discipline on employees’ willingness to report misconduct, their perception of the organization and of management. In a webinar marking the launch of the survey report (available below), NBE Co-founders Anna Romberg and Niina Ratsula led a discussion with FRA Partner Yousr Khalil and Fortifai CEO Abbey Lin, taking a deep dive into what discipline should look like in a successful compliance environment.  

While the survey gathered input from 4,000 respondents across companies in Finland, Sweden, Denmark and Norway, the panel discussed the findings in a global context, combining international regulatory experience and their knowledge of Nordic business practice and culture. FRA is pleased to have sponsored the NBE surveys since they began in 2019.

Discipline is a cornerstone  

The five components of a “formal” program as outlined by the NBE for purposes of the survey were:  

1. A dedicated ethics & compliance function  
2. A whistleblowing channel
3. Ethics & compliance training  
4. A code of conduct  
5. Disciplining unethical behaviour

Discipline emerged as a significant differentiator. Respondents in organizations where employees recognized consistent disciplinary measures reported higher levels of trust, fairness, and confidence in speaking up. Anna Romberg noted that this was a topic worth delving into because not only did it have great impact, it was also arguably one of the most difficult to put in practice.

"Only 15% of respondents who stated that unethical conduct is not disciplined in their organizations also agreed that the leadership and management is fair and ethical." - NBE Survey 2024

FRA’s Yousr Khalil highlighted that US Department of Justice (DOJ) guidance called for companies to have more than just a “paper” program, and to ensure that misconduct is consistently investigated and disciplined. Demonstrating that investigation results and disciplinary actions have been communicated to the rest of the company appropriately is important.

“It’s not just about the nature of the wrongdoing, but how the company explains it and the consequences in the context of their ethics and compliance program. How can you demonstrate that the disciplinary action was commensurate and consistent with both internal guidelines and local laws?” – Yousr Khalil

Transparency versus privacy

While transparency with stakeholders and employees is essential, balancing this against the imperative for individual and business confidentiality is delicate in practice. Some companies might fear triggering regulatory scrutiny or breaching the personal privacy of whistleblowers and individuals under investigation.  

Abby Lin, founder and CEO of regulatory technology company Fortifai, noted that some companies also worried that sharing data proactively might affect the culture of trust in an organization. She argued that more transparency signalled more accountability, adding that she encouraged companies to anonymize the data to the extent necessary to share with employees.  

As for the possibility of this data leaking to media or regulators, Yousr said that leadership’s first obligation was to assess the veracity of any allegation. Using the data to inform internal allegations gives you the upper hand in deciding whether an issue is worth self-disclosing to regulators or not. A “head in the sand” approach might only lead to failure to comply with legal/regulatory requirements, and leave employees the space to talk behind closed doors. It is always better to take control of a potential investigation upstream.

“Trust, but verify”: safeguard an ethical culture

Anna (NBE) recalled how the first year of the NBE survey revealed a culture of silence in the Nordic corporate culture, where respondents’ true perception of ethics and compliance did not match the high standards that many assumed of the Nordic community, but employees were not comfortable raising their voices about it. In the years since then, dedicated E&C functions were gaining ground, while new generations of employees and growing awareness of business responsibility were encouraging more people to get involved.  

On how this compared to FRA’s experience with global clients, Yousr acknowledged the positive culture of trust in the Nordics that allowed people to be innovative and drive change. She emphasized that trust should be accompanied by continuous verification, whether through data (training completion, internal reporting, investigation outcomes, employee surveys, etc) or qualitative discussions. This should feed into continuous updating of E&C programs as well, because employee and stakeholder expectations will change as years pass.

Practical takeaways  

There was a very significant gap between top management’s and employees’ perception of the impact of a dedicated E&C function. While 80% of top managers felt employees would raise concerns with or without a dedicated E&C function, the breakdown showed that respondents were clearly more confident where formal elements were in place:

There are practical steps that management should take to safeguard the culture of compliance in their organizations:

1. Continue investing in dedicated E&C functions. Respondents from organizations with a dedicated E&C function were more likely to agree that people were treated with respect in every situation.  
2. Prioritize discipline. Similarly, respondents who observed that unethical conduct was disciplined in their organization were significantly more likely to agree that their leadership/management was fair and ethical.  
3. Harness data for insight. As highlighted by the speakers, even anonymised data goes a long way in informing better business decisions, speaking up without fear of retaliation, and training.  
4. Balance transparency with privacy. While this is a tricky balance that depends on jurisdiction and regulations, engaging the right expertise to build a tailored approach can reap rewards for the organization’s compliance culture.  
5. Foster trust and accountability. A low incidence of reporting does not automatically mean a well-developed ethics and compliance culture. It may be more indicative of a culture that needs investment and possible reset. Management should be bold in putting the right infrastructure in place for an ethical and compliance workplace.

Download the survey report here.

We thank FRA Director Sharon Hall for her input to the above insights.