Compliance Ethics & ®

August 2017 Professional

a publication of the society of corporate compliance and ethics www.corporatecompliance.org

Meet David S. Huntley

Senior Executive Vice President & Chief Compliance Officer AT&T, Dallas, TX

See page 16

29 33 39 41 How to create  Can Bring your compliance Built to last: Top 5 a culture of ethics be program to life reasons your compliance trust? monitored? through technology initiatives fail William Holzhauer Robin Singh Sunil Bheda Amii Barnard-Bahn

This article, published in Compliance & Ethics Professional, appears here with permission from the Society of Corporate Compliance & Ethics. Call SCCE at +1 952 933 4977 or 888 277 4977 with reprint requests. FEATURE

Meet David S. Huntley Senior Executive Vice President & Chief Compliance Officer AT&T, Dallas, TX

an interview by Adam Turteltaub Meet David S. Huntley

David S. Huntley ([email protected]) was interviewed how you look at ethics and compliance. What in May of 2017 by Adam Turteltaub (adam.turteltaub@ corporatecompliance.org) Vice President, Strategic did your time in the business units bring to Initiatives and International Programs at SCCE, based in your ethics and compliance position? Minneapolis, MN. DH: I’ve been fortunate to work in and lead a variety of teams across the business—

August 2017 August external affairs, wireless operations, and

® AT: There are so many things I want to mergers and acquisitions to name a few. My discuss with you; it’s kind of hard knowing experiences included leading a large team of where to start. Maybe the best place is with employees dedicated to delivering outstanding your 23 years at AT&T. You spent most of your customer service for our mobility business. career in the Legal department, but you also This range expanded my perspective. I’ve been spent significant time holding senior positions in the trenches and understand the demands, in different business units leading thousands pressures, and expectations of these different of people. That must have had an impact on business roles. Compliance & Ethics Professional

16 www.corporatecompliance.org +1 952 933 4977 or 888 277 4977 FEATURE

It also taught me a lot about people. I trust. At AT&T, we adopted a simple mantra: observed what motivates them, what drives Just do the right thing. It’s an inherently simple their decision-making, and what might concept. Often, people already know what’s present a tempting shortcut. My biggest right. If you tell 6-year-olds to just do the right takeaway was that people need to feel thing, they know what that means. The same empowered. When you’re not empowered, thing applies to 16-year-olds leaving the house you’re waiting to be told what to do. Good on a Saturday night. leadership gives people This concept places a license to figure it out. the power in the hands But what affected Growing up, I of the employees. my view on integrity observed my father An ethical corporate and ethics the most culture gives them the happened long before conduct himself with confidence to make the I joined AT&T. That is a level of dignity that right decisions quickly my father’s influence. and boldly, which Growing up, I observed commanded respect. leaves more time to my father conduct He had a trademark of drive results. himself with a level of integrity. No one told I don’t want to dignity that commanded over simplify. There respect. He had a him to act that way— are moments when trademark of integrity. it came from within. we truly don’t know No one told him to act what to do. That’s that way—it came from why a values-based within. He was motivated by a personal desire code of business conduct, coupled with to just do the right thing. And that principle has an environment of continuous learning stayed with me throughout my life. and asking questions, is crucial. As Justice Potter Stewart elegantly phrased it, “Ethics AT: Being able to see things from the front- is knowing the difference between what line perspective must make you empathetic you have a right to do and what is right to to the challenges employees encounter when do.” This approach empowers employees to face-to-face with ethics and compliance issues, rely on their values and stop to ask for help but that doesn’t mean you can give them the when the rules aren’t clear or they don’t okay to blink and look away. How do you remember them. let people know that, no matter what, ethics and compliance responsibilities must be lived AT: You also spent a great deal of your up to? career in the Legal department. How have you 2017 August

DH: We hire and grow employees to found Compliance to be different than Legal? ® remember “YOU are the company.” It only DH: Both Legal and Compliance are takes one individual lapse to tarnish our designed to protect the company, but each reputation. Every employee represents who we department approaches it a bit differently. are and how we do business—that’s a sacred Rather than being more transaction driven, responsibility no one should take for granted. Compliance covers culture and is all The whole employee base needs to be encompassing. It focuses on behaviors that empowered to drive a culture of integrity and exist in all that we do. Compliance & Ethics Professional

+1 952 933 4977 or 888 277 4977 www.corporatecompliance.org 17 FEATURE

Traditionally, people viewed the DH: The AT&T Board of Directors takes Compliance team as the company ethics and compliance very seriously. One of enforcers. Today, we want to be known the ways they demonstrate this commitment as a team that’s here to help protect is ensuring that, as CCO, I have a seat at and keep the company safe. We’re here their table. I have the privilege of meeting to lend support. We’re taking a simple with the board regularly and reporting message—Just do the right thing—and on relevant matters as needed. We all see making it part of each employee’s the headlines—ethics and compliance are thought process as we evolve to be more front and center in the news. It proves good ethics-focused. practices can drive business value. That has not been missed by our board, and I believe an AT: AT&T keeps the two departments engaged and informed board is vital to a truly separate. You report directly to the CEO. successful business. Were Ethics and Compliance always a standalone team? If not, when did the AT: It’s great that you have direct access, structure shift and why? but what are the risks? I’m sure you don’t want DH: At AT&T, the Corporate to go to them too often, or for that matter, not Compliance group previously reported enough. How do you judge when is the time to into the Finance organization rather than reach out and when is the time not to? the more traditional placement under DH: I’m in the room for every board the Legal department. In late 2014, I meeting, have a seat at the table, and was named Chief Compliance Officer interact directly with board members. That (CCO) and we significantly shifted access is invaluable. My philosophy is, the our structure. We created a team that more transparent we are and the more we stands independently from any other communicate, the better. That said, it’s also department. In fact, I’m the first CCO important when you have the floor to be to report directly to the CEO in AT&T’s concise, be relevant, and be timely. 140-year-plus history. I work closely with our board’s Audit As an organization, we’re here to Committee, which has compliance oversight create a culture that promotes ethical responsibilities. Beyond the regular reporting conduct and upholds our commitment schedule of the committee, we also provide to comply with the law. We are a topical updates when appropriate. Because support team; we provide oversight and we proactively identify potential issues coordinate efforts across our company and evaluate the risk to make sure our to help them get it right. It’s not just own house is in order, we are prepared for

August 2017 August compliance. It’s compliance and ethics. timely discussions. When a compliance or

® We emphasize the importance of Just do ethics issue—good or bad and regardless of the right thing because when employees company or industry—makes headlines, we know what’s right, and it’s personal, they talk about it. Those opportunities let us check are truly empowered. ourselves on the issue and brief the board on our own policies and safeguards. AT: Do you also meet regularly with the board? How often do you meet and AT: For a lot of ethics and compliance what is your role? officers, communicating to the board Compliance & Ethics Professional

18 www.corporatecompliance.org +1 952 933 4977 or 888 277 4977 FEATURE

directly is relatively new. What advice First, we strive to make sure the rules are would you give them for making the most clear and accessible. However, we know there of the board’s time, and for getting the are instances where there are no specific rules board to focus on the right things? to follow, and that’s where values come in, DH: Whether you have a seat at the which is the second part—we’re empowering table already or are working to get one, my employees to use values and just do the advice is to focus on demonstrating value. right thing. Illustrate the value of A key driver compliance and ethics to accomplish our to the company. Show Research shows that approach and the value of having a in an ethical business effectively reach representative voice in employees is the room. Be articulate. environment, your providing tools that Prepare for every people work harder and are accessible, so they meeting and be ready can stop to ask for with a relevant point stay with you longer, help along the way. of view. your customers trust We’re leveraging As compliance you, and your business technology and going professionals, we mobile with our know the value of ultimately makes resources wherever building an ethical more money. we can. We’ve culture. Research launched interactive shows that in an compliance training ethical business environment, your people for all levels of the company. We strive work harder and stay with you longer, your to reach as many employees in person as customers trust you, and your business we can, particularly at the critical middle ultimately makes more money. The key management levels. Even our Code of Business is demonstrating that value and what it Conduct is interactive and can be accessed means to your specific business or industry. externally. We continue to roll out new ideas, In my case, our CEO understands and such as our Ethics@Work toolkit, which appreciates the value of the CCO to our organizes resources and messaging to help whole company. That endorsement and managers own their team’s compliance and support is vital. ethics culture.

AT: Let’s switch gears and talk about the AT: And how do you make it easy for them workforce. I saw online that AT&T has more to reach you? 2017 August than a quarter of a million employees, and DH: There are many ways employees can ® many of them are in the field all day. How reach us with their concerns and questions, do you effectively reach them? or to confidentially report an issue. “Ask DH: We’re working to change the Compliance” is an employee resource we perception of compliance from being promote regularly where employees can get an annual box-to-check to being part of answers by phone or email. And, of course, employees’ everyday lives. It’s a simple, there is a hotline employees can call to two-step approach. report issues. Compliance & Ethics Professional

+1 952 933 4977 or 888 277 4977 www.corporatecompliance.org 19 FEATURE

Another is an interactive online tool leadership, the Compliance team, and all levels where employees can walk through different of business unit leadership. situations they may be experiencing. By answering a series of questions, users receive AT: One of the things that must make guidance on the appropriate action to take, or your job interesting is the constantly if more details are needed, the resources that changing nature of your industry. can help. This tool has generated more than Traditional phone companies are in the 120,000 uses since its launch in January 2016, Internet, mobile, entertainment, and illustrating that most technology space. employees want to do Many of those the right thing—but It’s powerfully effective businesses are we must make it easy in reaching employees highly regulated, for them to know and all of them are what that is. when you have consistent quickly evolving. We’ve also messaging from How do you focused on making stay on top of our Compliance corporate leadership, the the changes? team members Compliance team, and DH: In Thomas more visible and Friedman’s latest accessible whenever all levels of business book Thank You for and wherever we unit leadership. Being Late, there’s can. We encourage a quote from Dov direct engagement Seidman. It says, by leveraging our relationships with the “The world is not just rapidly changing, it is different business unit teams. As we build on being dramatically reshaped—it is starting our role, we continue to raise our profile as a to operate differently in many realms all go-to resource. at once. And this reshaping is happening faster than we have yet been able to reshape AT: A related and important question is, ourselves, our leadership, our institutions, how do you ensure that the culture extends our societies and our ethical choices.” throughout the organization? There’s been a similar reshaping in DH: We do a lot of work with our Employee the way businesses operate. We can now Communications team to make sure the Just target content and products with incredible do the right thing mantra stays front and center. accuracy. We can segment customers We highlight stories of employees doing and markets in ways we never imagined.

August 2017 August the right thing and host various events and But, as we implement new ways to meet

® activities, not just at certain times, but in a customers’ needs, our intentions behind how steady drum beat through the year. we develop these innovations are critical. We’re empowering each business unit We must have a foundation of integrity in to own and drive our ethical culture by our approach. providing tools, resources, and a close I often remind our leaders to ask working partnership. It’s powerfully themselves, “What would people think if effective in reaching employees when you our intentions were on display for all to have consistent messaging from corporate see?” Transparency and integrity must guide Compliance & Ethics Professional

20 www.corporatecompliance.org +1 952 933 4977 or 888 277 4977 FEATURE

our decisions. That’s non-negotiable. When them to understand our policies and give them customers know integrity is embedded in choices about how we use their information. our strategy, they trust us and, in turn, buy It begins by taking data privacy seriously. our products and services. We have comprehensive programs with We are committed to following the methods and procedures on how to handle law—following the spirit of the law. Our data, which reinforces the importance of program is designed to prevent and detect protecting our customers’ and employees’ issues, and we’re nurturing a culture that information. We leverage the latest in promotes ethical conduct. We believe this is technology whenever possible to reduce the right approach to preventing bad things threats. In addition to always encrypting from happening, and subsequently, helping sensitive information, we also use technology the company’s bottom line. to mask sensitive information so it is only visible when appropriate. We have strong AT: Do you think those efforts can help authentication protocols and use advanced smooth things over or risk creating more analytics to help identify behavior that might friction? indicate customer or employee information is DH: Our main message—Just do the at risk. right thing—is something that anyone from any company can understand. It’s a AT: For all the fears of protecting data from simple message, but one we believe is the hackers, we found in a survey last year that foundation for all we do—especially in such the most common cause of data breaches is a rapidly evolving industry. employee error, such as lost laptops and flash We have to be engaged and thoughtful drives, even paper files. How do you help your about how we do business. We must be workforce understand and manage this risk? flexible and move fast, but never so fast that DH: We provide the necessary oversight we don’t do things the right way. Ultimately, and policies to ensure we are staying ahead of cutting corners will cost more, damage known and emerging risks. As with all other your brand, and jeopardize the trust of your compliance risks, we take a holistic approach customers. Legendary basketball coach John so we aren’t operating in isolation. Ongoing Wooden said it perfectly, “If you don’t have education and top-of-mind awareness for time to do it right, when will you have time employees is fundamental to our coordinated to do it over?” efforts. For example, our Chief Security Office has a creative internal campaign called, AT: One of the greatest challenges ethics “You are the Firewall.” Through that program, and compliance professionals face these days video segments introduce security concepts is data privacy. The public is demanding more and situations that employees may experience 2017 August and governments are demanding more. How in real life to help drive the security best ® does your organization help AT&T navigate practices message home in a fresh, and this landscape successfully? sometimes humorous, way. DH: The short response is transparency and We work closely with our technology choice. Customer privacy is a fundamental teams, using many of the mitigation commitment at AT&T. We safeguard our procedures used to protect sensitive data to customers’ data using encryption and other also minimize accidents. For instance, we security controls. We strive to make it easy for aggressively encrypt customer and certain Compliance & Ethics Professional

+1 952 933 4977 or 888 277 4977 www.corporatecompliance.org 21 FEATURE

employee sensitive data. That includes companies and as individuals. I expect the encrypting the hard drives on laptops— trend of compliance organizations reporting to encrypting information in systems and the CEO and having direct access to the board laptops makes it inaccessible if they are lost of directors will continue. or stolen. For a Compliance department, it will When we protect customer and employee be impossible to train employees for every data, we protect our brand and reputation. situation. Even if you attempted to, your Nothing is more important. curriculum would be outdated before it’s complete. That’s why I reiterate the importance AT: Finally, how do you see the Ethics and of empowering employees—simply ask them Compliance profession evolving over the next to think about what’s right and give them the few years? tools to figure it out. DH: Our world is changing quickly and dramatically, evolving with new scenarios and AT: Thank you, David, for sharing your ethical situations we’ve never faced before as insights. ✵

Don’t forget to earn your CCB CEUs for this issue

Complete the Compliance & Ethics Professional To complete the quiz: CEU quiz for the articles below from this issue: Visit corporatecompliance.org/quiz, log in with your username and password, select a quiz, and answer the ·· Built to last: Top 5 reasons your compliance questions. The online quiz is self-scoring and you will see initiatives fail your results immediately. by Amii Barnard-Bahn (page 41) You may also fax or mail the completed quiz to CCB: ·· Analysis on the corruption perception in Turkey by Barıs Kalaycı, Filiz Toprak Esin, and Ömer Bayman FAX: +1 952 988 0146 (page 47) MAIL: Compliance Certification Board ·· Complying with corruption regulations: 6500 Barrie Road, Suite 250 Best practices Minneapolis, MN 55435, United States

August 2017 August by Matthew DeCicco (page 55) Questions? Call CCB at +1 952 933 4977 or 888 277 4977

®

To receive 1.0 non-live Compliance Certification Professional quizzes are valid for 12 months, beginning Board (CCB) CEU for the quiz, at least three questions on the first day of the month of issue. Quizzes received must be answered correctly. Only the first attempt after the expiration date indicated on the quiz will not at each quiz will be accepted. Compliance & Ethics be accepted. Compliance & Ethics Professional

22 www.corporatecompliance.org +1 952 933 4977 or 888 277 4977