Forwarding from The FCPA Blog – “Yes, ‘ethical culture’ can be measured” or audited – and so can governance, risk management, compliance, and almost everything, etc. . . .

I am forwarding a July 22, 2019, post by Vera Cherepanova on the FCPA Blog – the following is the link to Ms. Cherepanova’s post:

Ms. Cherepanova highlights the recent Department of Justice update to its “Evaluation of Corporate Compliance Programs,” and also references the U.S. Federal Sentencing Guidelines, noting that both in part refer to the importance “for a company to create and foster a culture of ethics and compliance.” She then queries: “But how does a company measure its culture of compliance, and what steps does it take in response to its measurement of the compliance culture?” Responding to her query, Ms. Cherepanova states, “Although they sometimes may be labeled differently, the key five you would want to incorporate [into] your measurement include the following: Achievability of targets, goals, and tasks . . . Communication . . . Leadership . . . Organizational justice . . . [and] Accountability.”

I view the blog post as discussing at least two issues: “yes, ethical culture can be measured,” and “criteria that might be used to measure ethical culture.” My response to the first issue also is “yes.” In fact, ethical culture not only can be measured, but can also be audited, such as by internal audit or outside audit. Related to culture, tone-at-the-top and internal controls and control processes have long been recognized as elements in an audit at least from the standpoint of evaluating the possibility of fraud and the extent to which records can be relied upon in designing the audit. Almost anything can be audited including, for example, not just financial transactions but also governance, risk management or risk management processes, compliance with laws, and the list is almost endless.

The more challenging issue is what criteria to use to measure or audit ethical culture and other areas? And, of course, there are follow up issues such as determining who will actually perform and evaluate the measurement or audit process, and will the task of establishing ethical culture not only involve management but also oversight by the board, or the audit committee, or a separate risk committee? Guidelines require board and/or board committee oversight. Relevant to these issues, also click on the following link for a May 2019 post that I wrote about the new DOJ guidelines

Ms. Cherepanova lists some good key areas to measure or audit. It is possible to add additional key areas, and additional criteria can be added to the five areas that the blog post identifies. I’m not being critical of the five key areas that are listed, instead, I am merely pointing out that there is lack of agreement on the key areas to include in the measurement or audit process. Certainly at least DOJ and court case guidance should be consulted. It should also be added, for example, the establishment of a robust anonymous reporting process, and related investigation processes. In addition to others, you should also consult legal counsel for additional guidance. Consider using a team approach as these topics can require input from attorneys and other professionals who have backgrounds in a multitude of different areas.

Ms. Cherepanova’s post raises many additional issues, in fact too many to cover in this post. Under Leadership and Accountability, for example, does or will the alleged wrongdoer’s stature or status within the organization impact the investigation and/or the resulting discipline, if any? These can be difficult questions. Whereas one might argue that stature or status should not be relevant criteria, the severity of disciplinary measures can both positively and negatively impact an organization when a key member of the organization is involved.

My view has been and remains that organizational culture and ethical culture are here to stay as significant or at least relevant organizational issues.


Remember, every case and situation is different. It is important to obtain and evaluate all of the evidence that is available, and to apply that evidence to the applicable standards and laws. You do need to consult with an attorney and other professionals about your particular situation. This post is not a solicitation for legal or other services inside of or outside of California, and, of course, this post only is a summary of information that changes from time to time, and does not apply to any particular situation or to your specific situation. So . . . you cannot rely on this post for your situation or as legal or other professional advice or representation.

Thank you for reading this website. I ask that you also pass it along to other people who would be interested as it is through collaboration that great things and success occur more quickly.

Best to you, David Tate, Esq. (and inactive California CPA) – practicing in California only.

I am also the new Chair of the Business Law Section of the Bar Association of San Francisco.

Blogs: Trust, estate/probate, power of attorney, conservatorship, elder and dependent adult abuse, nursing home and care, disability, discrimination, personal injury, responsibilities and rights, and other related litigation, and contentious administrations; Business, D&O, board, director, audit committee, shareholder, founder, owner, and investor litigation, governance, responsibilities and rights, compliance, investigations, and risk management

The following are copies of the tables of contents of three of the more formal materials that I have written over the years about accounting/auditing, audit committees, and related legal topics – Accounting and Its Legal Implications was my first formal effort, which resulted in a published book that had more of an accounting and auditing focus; Chapter 5A, Audit Committee Functions and Responsibilities, for the California Continuing Education of the Bar has a more legal focus; and the most recent Tate’s Excellent Audit Committee Guide (February 2017) also has a more legal focus:

Accounting and Its Legal Implications

Chapter 5A, Audit Committee Functions and Responsibilities, CEB Advising and Defending Corporate Directors and Officers

Tate’s Excellent Audit Committee Guide

The following are other summary materials that you might find useful:


Audit Committee 5 Lines of Success, Diligence, and Defense - David Tate, Esq, 05052018

COSO Enterprise Risk Management Framework ERM Components and Principles

From a prior blog post which you can find at if the below scan is too difficult to read:

* * * * *