3M

As part of its global Ethics & Compliance Program, 3M has a Risk Monitoring pillar that utilizes different processes and tools to monitor new and emerging compliance risks actively, assesses the effectiveness of the compliance program, and creates tools to facilitate reporting to leaders at all levels of the state of risk through metrics and data analytics.

This article highlights one element of the Risk Monitoring Pillar used by 3M to monitor and test the effectiveness of 3M’s compliance program, known as Compliance Evaluations. The Evaluation process reviews individual 3M businesses, internal service models, and acquisitions, and reviews are selected annually on a risk-prioritized basis. The Evaluation process has been in place for over a decade and continues to evolve based on learnings from our experiences. Executive management supports this process due to the value and insights it provides. In times of limited resources and budgets, this also helps to allocate resources dynamically to areas with the highest priority.

The process is two-pronged: an assessment of Compliance Culture and a review of Books and Records.

Compliance Culture

Compliance culture is assessed and measured through a unique process of employee engagement. A representative sample of employees is invited for in-depth confidential interviews that cover compliance risk and cultural topics. The topics include employee awareness of compliance controls, understanding of specific compliance risks, and discussing leadership tone setting and role modeling. The interviews are conducted by a team of compliance subject matter experts predominantly from the Ethics & Compliance function and are an opportunity for the employee to share experiences and relay questions or raise concerns related to such topics as:

• The comfort and knowledge of how to speak up or report concerns;

• Questions about present or past business practices;

• Workplace respect, including inclusion and equity issues;

• Understanding of conflict of interest;

• Business courtesies and other activities that involve higher risk transfers of value to third parties;

• Knowledge of bribery and corruption risk; and

• Overall knowledge of compliance-related expectations.

The interviews are customized based on the individual being interviewed and potential risk created by the entity being reviewed and can include topics such as data privacy and antitrust risk.

A key ancillary topic that is covered is employee morale. Morale can play a role in the willingness of employees to raise a concern, so assessing morale helps raise management awareness of underlying risks and take actions to address the issues.

Books and Records

The books and records review includes testing of sample transactions and review of documentation to validate compliance with existing policies, standards, and procedures. Centralized data lakes and data visualization tools are used to provide better access to both raw data and analytics. This helps to analyze data efficiently to ensure accuracy, completeness, and, where required, awareness or refreshment of compliance-related procedures. 

Additionally, contracts are reviewed to ensure appropriate compliance provisions are included in the agreements. 

From time to time and resources permitting, evaluation team members may also engage customers directly to receive an external perspective of 3M’s compliance program.

The work product is a detailed report with a wide internal circulation that includes observations that create better awareness for management and findings that require remediations.

The process emphasizes transparency from start to end and commits to providing all those involved with the review results.