Let's Get Ethical
A new survey reveals how higher education is faring in the ethics and compliance arena.
By Tina S. Sheldon and W. Michael Hoffman
A number of government investigations have meted out multimillion dollar fines and penalties to higher education institutions, and in some cases, suspension of federal research dollars. This increased scrutiny prompted the Center for Business Ethics at Bentley College in Waltham, Massachusetts, to launch a first-of-itskind national survey in December 2003 to examine the state of institutionwide ethics and compliance programs at four-year colleges and universities.
The survey results reveal that the majority of institutions believe that they should have the elements of an ethics and compliance program in place. Although a fair percentage of institutions have had some components for years, many campuses lack all of the elements necessary for meeting the Federal Sentencing Guidelines. Overall, the data show that higher education still has work to do in the ethics and compliance arena.
Cracking Down on Noncompliance
Compliance programs were brought to the forefront of corporate America in 1991 when the United States Sentencing Commission promulgated the Federal Sentencing Guidelines for Organizations. When the guidelines were first issued, many people thought they only applied to large, for-profit organizations. College and university cases, however, have put compliance programs on the map for higher education.
Under the guidelines, an organization’s punishment for criminal offenses was adjusted according to several factors, one of which was whether the organization had an effective compliance program to prevent and detect violations of law. For such a program to be effective, the commission outlined seven minimum elements: written standards; oversight; due diligence in delegation of authority; communication and training; monitoring and auditing; enforcement and discipline; and corrective action. This represented the federal government’s first attempt to articulate broad-based standards and quickly became the benchmark against which most organizations measured their compliance programs.
During the mid-1990s, the government investigated and fined numerous academic medical centers and faculty practice plans. In response, the Department of Health and Human Services published compliance program guidance for hospitals in 1998. Subsequently, the government issued guidance for all facets of the health care industry, such as physician practice plans and laboratories.
In April 2004 the commission reexamined the guidelines and submitted amended guidelines to Congress. They reflect the changing regulatory landscape and business environment in which organizations now find themselves. Historically, the commission focused only on compliance with the law, but under the amended guidelines the focus has broadened to include corporate culture and ethical conduct.
Against this backdrop, Bentley’s Center for Business Ethics undertook an initiative to learn how colleges apply ethics and compliance oversight across their institutions. Given the variability in nomenclature, the survey used the terms “ethics program” and “compliance program” synonymously, defining them as any program that was established and implemented to oversee, manage, and address compliance, ethics, business conduct, or risk management issues and initiatives within a college or university. The survey focused on institutionwide ethics and compliance programs, distinguishing them from ethics and compliance programs that are topic-, school-, department-, or entity-specific, such as hospitals.
A confidential, Web-based survey was developed and sent to 2,399 college and university presidents and chancellors, generating 466 responses. Almost a third of the survey respondents (32 percent) were public institutions and more than two-thirds (68 percent) were independent institutions. With respect to student body size, 70 percent of respondents had 5,000 or fewer students, and more than a quarter (28 percent) of those institutions had fewer than 1,000 students. Another 10 percent of respondents had between 5,001 and 10,000 students; 13 percent had between 10,001 and 20,000; and 6 percent had more than 20,000 students.
Only 43 percent of the colleges and universities participating in the survey had an institutionwide ethics and compliance program, yet 79 percent thought they should have such a program. While this disparity may appear significant, the survey also found that 17 percent of campuses that do not currently have a program have begun to develop one. This indicates a trend toward such programs in higher education.
Given the compliance timeline, the researchers asked when these programs were established. The survey found that 48 percent of those with a program have had one for six or more years, with nearly a third (31 percent) having established their programs 11 or more years ago.
Most colleges (80 percent) developed their program because it was the “right thing to do.” Twenty percent of campuses developed their program for a variety of other reasons, including a state statute, a corporate integrity agreement, a government investigation, an adverse event, a board mandate, or a religious mission.
Respondents with an institutionwide program applied it to their administration and faculty in 88 percent and 85 percent of cases, respectively. In addition, 60 percent of respondents reported that their program applied to students, a fairly transient population in higher education communities. Regarding the freedom of faculty to teach and conduct research without censorship, the survey found that academic freedom only affected 21 percent of the respondents’ programs, even though 85 percent of colleges with an institutionwide program apply it to faculty. This finding might appear counterintuitive given that academic freedom creates a unique standard for a large sector of the campus community. Of those affected by academic freedom, more than a third of respondents (38 percent) felt that professional values conflict with the institution’s values, and 24 percent reported that academic freedom makes it difficult to hold people accountable.
Only 65 percent of those with a program reported that it applied to their governing board or trustees. Although the Sarbanes-Oxley Act does not directly apply to nonprofit organizations, it is noteworthy that only a third of institutions with a program thought that the act affected their campuses given that the regulatory landscape is stressing greater controls, financial stewardship, and accountability. However, when asked about fiscal responsibility, the majority of those with a program require senior officers to maintain an effective system of internal controls (92 percent), disclose internal control deficiencies and known fraud (84 percent), provide full disclosure in financial reports (83 percent), abide by a code of conduct (82 percent), and certify financial statements (69 percent). This apparent inconsistency may be explained by the finding that 36 percent of colleges with a program did not think the Sarbanes-Oxley Act affected their business practices and 32 percent did not know if it affected their business practices.
More than three-quarters (77 percent) of those with a program have an audit committee composed of board members, with 64 percent of public institutions and 83 percent of independent institutions falling in this category. The survey also revealed that of those with an audit committee, 86 percent oversee accounting and financial reporting practices; 80 percent include a member with financial expertise; 76 percent of audit committee members do not accept consulting, advisory, or other fees from their institution; 67 percent appoint, compensate, and oversee external auditors; and 56 percent of audit committee members are required to disclose their employment and significant financial interests.
Keeping a Watchful Eye
Focusing on the seven key elements identified in the guidelines, the survey asked questions regarding oversight, standards, training, and monitoring. The 1991 guidelines recommended that highlevel individuals provide an oversight role. Organizations are given great latitude regarding how the position is crafted. However, the amended guidelines state that an organization’s governing authority should understand the program’s content and operations. Furthermore, boards of directors and executives must assume responsibility for oversight and management. In other words, highlevel personnel and the board should ensure that the organization has an effective program.
Specifically, the survey found:
- More than half (56 percent) of institutions with a program have an ethics or compliance officer, with 67 percent of public institutions and slightly less than half (48 percent) of independent institutions having such a position.
- Less than half (42 percent) of the institutions with a program have an ethics or compliance committee, with slightly less than half (47 percent) of public institutions and a little more than a third (36 percent) of independent institutions with such an oversight body.
- Only 62 percent of all respondents thought that a university should have an oversight function (in the form of an ethics or compliance officer or committee). Specifically, 76 percent of public institutions and 58 percent of independent institutions took this position. Only a third of those in the process of developing a program are considering an ethics or compliance officer and only half are considering an ethics or compliance committee. The findings suggest that many colleges do not yet perceive this oversight function as a necessary and vital component of an institutionwide program.
- Consistent with the longevity of the program, slightly more than half (53 percent) of campuses have had an ethics or compliance officer for six or more years, with a quarter having taken the initiative 11 or more years ago. Similarly, 51 percent of those with an ethics or compliance committee have had such a committee for six or more years, with slightly less than a quarter (24 percent) having had one for 11 or more years.
The survey found that 79 percent of campuses have one or more full-time employees responsible for ethics and compliance. Colleges with three to five full-time employees mostly had more than 10,000 students; colleges with six or more full-time employees all had 10,000 students or more. This appears to be consistent with the commentary of the amended guidelines offering that resources allocated to an ethics and compliance program should be commensurate with the size and structure of the organization. While this sounds encouraging, it is also noteworthy that 84 percent of those with an ethics or compliance officer require the incumbent to perform other duties or hold other positions as well. Moreover, in such cases, nearly two-thirds (65 percent) of the relevant employees spend 30 percent or less of their time on ethics and compliance matters and another 15 percent spend between 31 and 60 percent of their time on ethics and compliance matters.
The amended guidelines also state that individuals with operational responsibility should periodically report to high-level personnel. To this end, the survey found that 73 percent of ethics or compliance officers report to the president, provost, or chancellor, with 85 percent of public institutions and 60 percent of independent institutions having such a reporting relationship. Only 7 percent of officers reported to the vice president for finance, the vice president for administration, or the general counsel. Ethics or compliance officers reported to the governing board and audit committee in 13 percent and 5 percent of cases, respectively.
Ethics and compliance committees were predominately composed of senior administrators (76 percent) and faculty (75 percent). Less than two-thirds (61 percent) of those with such a committee included staff, and 27 percent included students. Onetenth of institutions reported other representation on the committee, including trustees, community leaders, members from the umbrella organization, and ad hoc members. The survey found a large gap in the number of times these committees convened. Less than a third (31 percent) met one to three times a year, less than a quarter (24 percent) met four to six times a year, and less than a third (31 percent) met seven or more times a year.
Putting It on Paper
Written standards set forth guiding principles regarding employee conduct. This is the one element of ethics and compliance programs to which the survey found the greatest adherence. The survey found:
- 92 percent of those with a program have a written statement of the institution’s core principles or values, and 91 percent have a code of ethics or conduct;
- of all respondents (both with and without an institutionwide ethics and compliance program), 91 percent thought they should have an ethics or compliance statement;
- 62 percent of colleges with a program have had a values statement and 69 percent have had a code of conduct for seven or more years; and
- of those with a program, 77 percent have revised either their values statement or code of conduct, with 76 percent of those institutions having a formal process to do so.
The written standards are only effective if they are communicated throughout the organization. While only 50 percent of campuses with either a statement of values or a code of conduct communicated their standards through training, 78 percent of those with written standards communicate them through their faculty and employee handbooks. Furthermore, the survey found that 57 percent of colleges with written standards publish them online, and 27 percent communicate their written standards through mailings.
Communication and Training
The amended guidelines state that organizations should take reasonable steps to periodically communicate their standards and procedures and other aspects of their program. How do colleges measure up?
- Sixty percent of those with a program offer training on ethics and compliance matters; however, 83 percent of all respondents thought they should have ethics and compliance training. Clearly, the majority of respondents believe such training is important, yet many do not offer it.
- Of those with a program that provide ethics and compliance training, the majority (80 percent) offer training on their values statement or code of conduct. More than half of that group (56 percent) offers such training one to four times a year.
The amended guidelines also state that ethics and compliance communication and training should be made available not only to the organization’s employees but to the governing authority, highlevel personnel, substantial authority personnel, and as appropriate, the organization’s agents. The survey found that those with a program offer values statement or code of conduct training to senior administrators (94 percent), staff (93 percent), and faculty (90 percent). In addition, 57 percent of those institutions offer such training to their students. This is fairly consistent with the finding that 60 percent of campuses’ programs apply to their student body.
Of the colleges that offer ethics and compliance training, the survey found that 72 percent mandate that training. Specifically, 68 percent require training on their institution’s values statement or code of conduct. Those that mandate values statement or code of conduct training require that the majority of the academic community participate, including senior administrators (88 percent), staff (93 percent), and faculty (90 percent). However, less than half (44 percent) require students to participate in such training.
The amended guidelines also suggest that communication can be accomplished by disseminating information via a number of mechanisms. Almost half (43 percent) communicated ethics and compliance matters through the Web, with 62 percent of public institutions and 31 percent of independent institutions using this vehicle. More than two-thirds of institutions with student populations greater than 10,000 used the Web, whereas slightly more than a third of those with less than 10,000 students used the Web. This may be a reflection of size and resources. Colleges disseminated information through brochures (33 percent), newsletters (30 percent), articles (28 percent), and posters (24 percent). In addition, 18 percent used some other mechanism to communicate information including letters, memos, e-mails, training materials, handbooks, payroll inserts, forums, meetings, and hanging framed materials.
Monitoring and Auditing
Monitoring and auditing are also essential components of any ethics and compliance program for reporting and detecting misconduct. The guidelines state that organizations should periodically identify risk areas as well as assess the program’s effectiveness.
Only a third of those with an institutionwide program had a helpline or hotline for reporting misconduct or seeking advice. Of this third, 35 percent have established a helpline within the past three years and 36 percent within the past four to six years. Only 18 percent have had a helpline for seven or more years. Given that almost half of the campuses with a program have had their program for six or more years, implementing a phone line as part of the program’s infrastructure is not perceived as a priority by most. The percentage of those with a phone line is low considering the survey findings that 78 percent of all survey respondents thought that they should have a forum for reporting misconduct.
However, the guidelines do not specify that organizations must have a phone line for reporting. Many colleges have instituted other forums or mechanisms for reporting potential misconduct. For example, 63 percent use e-mail and 24 percent use a private post office box. Of those respondents that do not have an institutionwide program but are in the process of developing one, only half have considered forums for reporting misconduct.
Other findings related to monitoring:
- Eighty percent of those with a program monitor ethics or compliance issues, and 89 percent of all respondents thought they should monitor ethics and compliance issues.
- Of those with a program, 81 percent perform routine monitoring, 72 percent conduct reactive reviews, and 56 percent conduct proactive reviews.
- Compliance officers monitor these issues 60 percent of the time, with 72 percent (public) and 53 percent (independent) of compliance offices taking on these responsibilities.
- A number of other individuals both within and outside the organization have responsibility for monitoring ethics and compliance matters. The survey found that more than half of those with a program have internal auditors monitor ethics and compliance issues (57 percent) and 51 percent use outside auditors for this purpose. The survey also found a wide variance between public and independent institutions. Internal auditors monitor ethics and compliance issues at 76 percent of public universities and 44 percent of independents institutions. Almost a third of those with a program (31 percent) rely on the general counsel’s office to perform ethics or compliance monitoring. About a tenth of those with a program engaged consultants or outside counsel to perform such a role, 14 percent and 11 percent of the time, respectively. Twenty-seven percent of those with a program indicated that other internal positions performed such a role, including senior administrators, vice presidents, and deans, as well as committees, such as the board of trustees, the audit committee, and the state ethics commission.
Persevering on the Straight and Narrow Path
Given the compliance timeline, higher education has made substantial inroads in developing and managing ethics and compliance programs. While less than half of all respondents have an ethics and compliance program, almost a fifth of respondents without a program indicated that they are moving in that direction. The survey also found that there are several elements of an ethics and compliance program that colleges have instituted. Most of those with a program have written standards (either a values statement or a code of conduct). More than half of those with an ethics and compliance program offer training and more than two-thirds of those mandate training of their senior administrators, staff, and faculty. These are solid foundations for building ethical cultures.
Conversely, the survey found some areas where the industry is lagging behind, such as oversight. Slightly more than half of institutions have an ethics or compliance officer and less than half have an ethics or compliance committee, yet almost two-thirds of all respondents believe that there should be an oversight function. This is an opportunity for all colleges and universities to either assess or reassess their programs and organizational structure and culture and make adjustments and enhancements.
Author Bios Tina S. Sheldon is the senior compliance officer at Harvard University, Boston, and is a Center for Business Ethics Research Fellow. W. Michael Hoffman is founding executive director at Bentley College’s Center for Business Ethics, Waltham, Massachusetts.
E-mail firstname.lastname@example.org; email@example.com
- NACUBO and FASB Discuss Grant Revenue Recognition
- ED Proposes Auditing Safeguards Rule Compliance
- NACUBO and ACE to Negotiate Rates for Use of Music on Campus
- WEBCAST: NACUBO Live! 2017 Higher Education Accounting Forum
May 7-9, 2017
- WEBCAST: Update to Strategic Financial Analysis in Higher Education, 7th Edition: Corrections and Clarifications
Thursday, May 25, 2017 1:00PM ET
- WEBCAST: Results of the 2016 NACUBO Tuition Discounting Study
Wednesday, May 31, 2017 1:00 PM ET
- ON-DEMAND: How to Budget for Technology That Aligns with Institutional Goals
- ON-DEMAND: What’s Happening in Student Financial Services?
- ON-DEMAND: Legislative Lunchcast: A 30-Minute Washington Update from NACUBO