News

Ensuring Ethical Behavior by Services Providers and Other Third Parties

March 19, 2008 | Stephen Miler

Employers are growing more dependent on relationships with third parties to provide HR services such as benefit program administration, recruitment and staffing management, and as partners in joint ventures.

But while suppliers of HR services, temporary employees, contractors and business partners can help reduce costs, improve efficiencies and remove business barriers, companies are increasingly recognizing that such arrangements can expose them to legal and reputation risk, according to a new report by The Conference Board, Finding the Right Balance: The Essentials of Third Party Ethics Programs.

"Companies struggle with competing tensions that arise from developing business relationships with partners that aren't always mindful or responsive to a broad range of their own stakeholders' concerns, such as environmental compliance, health and safety, and human rights," comments report co-author Rebecca Walker, an attorney specializing in corporate compliance and business ethics.

To enable companies to benchmark their policies and procedures against those of other organizations, The Conference Board and the Ethics and Compliance Officer Association (ECOA) surveyed 169 companies about their practices to ensure ethical behavior by third parties. Among the key findings:

Written policies applicable to specific third parties are not common. The most typical way of handling third-party ethics and compliance issues is to adopt a code of practice that governs the manner in which the company's own employees deal with third parties.

Companies show little interest in the third party's own ethics programs. Slightly more than one-quarter of the participating companies ask third parties whether or not they have them, but only 14 percent of respondents ask for documentation.

Performing Due Diligence
Background or due diligence checks are preferred to insisting that the third party adopt the company's ethics and compliance programs, the survey found. When it comes to due diligence:

77 percent of respondents perform checks on certain third parties prior to entering into a business relationship.

About half subject all categories of third parties to due diligence.

As regards the focus of due diligence searches, disabling financial or legal conditions are more likely than reputational impairments to be the objective of scrutiny.

Common Initiatives

The most common ethics/compliance initiatives that companies extend to their business partners include:

Offering employees of third parties an opportunity to report ethics- or compliance-related concerns. Virtually all of these systems (98 percent) rely on the same means used for a company's own employees to report suspected misconduct, rather than a separate system for third parties. The most popular mechanisms are providing e-mail addresses (65 percent) and telephone help lines (61 percent).

Establishing a way for third-party employees to report concerns or misconduct was ranked as the easiest means of ensuring appropriate third-party compliance, while monitoring third-party behavior for compliance was rated by far the most difficult. "With the exception of help lines or whistle-blowing systems, the direct inclusion of third parties in companies' ethics and compliance programs is the exception, not the rule," says report co-author Ronald E. Berenbeim, a principal researcher at The Conference Board.
Addressing third-party risks in their company's risk assessment. Approximately 60 percent of survey participants do so, with agents, suppliers of services and contractors the most frequent subjects of these exercises; suppliers of goods are somewhat less often subject to scrutiny. Companies are evenly divided as to whether the risk assessment is part of a broader enterprise risk process or limited to ethics and compliance risks.
Extending their ethics and compliance training programs to third parties. Slightly more than one-third (38 percent) of survey participants offer but don't insist on some kind of training program for third parties. Most of these programs devote some discussion to the company's own code. In almost every case, those parties that are asked to adopt or certify adherence to the company's internal code of conduct are offered some form of training.

Infrequent Compliance Audits

Company audits of third-party compliance with ethics policies and practices are infrequent, and a majority of the companies that audit don't do so routinely, the survey found.

Slightly more than 35 percent of the survey participants perform audits or otherwise verify that third parties conduct themselves as required by the company's own compliance and ethics policies. Of this group, slightly less than half conduct audits on a routine basis, while the remainder focuses their audits on specific concerns.

Room for Improvement

"The survey suggests that companies are satisfied with current methods of seeking to extend ethics and compliance standards or requirements to third parties but are willing to search for new approaches," says Berenbeim. "Companies rated all ethics and compliance efforts within a narrow and not especially positive range—they deemed them somewhat effective."

Stephen Miller is manager of SHRM Online’s Compensation & Benefits Focus Area.