Policies that require employees to self-report information won't stop illegal behavior, says Walter Kapuscinski, president of Kapco Group, Inc., a New York-based consultancy. But it does mean "they've done their regulatory oversight, and if the employee is lying, then it's the advisor's fault, not theirs."
Regulators have imposed penalties against firms in numerous cases for inadequate policies and procedures that lead to employee wrongdoing and other problems. Reputational damage associated with compliance transgressions can, in some cases, be more costly than the fine.
Deloitte, in contrast, can position Flanagan's conduct as an aberration. A Deloitte spokesman says it "unequivocally condemns" Flanagan's actions, which the company describes as "unprecedented." The agency informed Deloitte, he says, that it concluded its investigation won't be recommending an enforcement action against the company. Deloitte also won a liability case against Flanagan for breaching his fiduciary duty and will prove the company's damages at a trial, the spokesman says.
Compliance programs aren't intended to be absolute guarantees, says Judith Gross, a New York-based compliance consultant. "They're supposed to be reasonable efforts at stopping bad deeds. It's not that you have to actually stop all deeds." Done well, however, they can both promote an ethical culture and spare companies a lot of the embarrassment and pain that can come from an employee's wrongdoing.