Compliance By Fire Alarm: Regulatory Oversight Through Information Feedback Loops.

• Date: 01 January 2021
• Author: Orozco, David

I.INTRODUCTION 99 II.PERVASIVE AGENCY COSTS WITHIN THE COMPLIANCE SYSTEM 104 A. Regulators 105 1. Overview 105 2. Agency Costs 108 B. Firms 109 1. Overview 110 2. Agency Costs 113 C. Senior Executives 114 1. Overview 115 2. Agency Costs 116 D. Inter-Organizational Structures 117 1. Overview 118 2. Agency Costs 118 III.THE POLICING AND ARCHITECTURAL APPROACHES TO COMPLIANCE 119 A. The Policing Approach 119 1. Overview 119 2. Agency Costs 120 3. Examples 121 B. The Architectural Approach 121 1. Overview 121 2. Agency Costs 122 3. Examples 122 IV.THE FIRE-ALARM APPROACH TO COMPLIANCE 123 A. Overview 123 B. Agency Costs 125 V.INFORMATION FEEDBACK LOOPS 125 A. Regulators-Firms 127 1. Informal Notice-and-Comment Rulemaking 127 2. Board Oversight Duties 127 3. Independent Monitors 128 4. Public Disclosure Duties 128 5. Data Analytics 129 B. Regulators-Inter-organizational structures 130 1. Oversight 130 2. Complaints 130 C. Regulators-Executives 131 D. Regulators-Regulators 131 E. Firms-Inter-organizational Structures 131 1. Certifications 131 2. Private Information Disclosures 132 F. Firms-Executives 133 1. Specialized Board Committees 133 2. Agency Lines of Reporting and Authority 133 3. Data Management and Analytics 134 4. Anonymous Hotlines 135 G. Firms-Firms 135 H. Inter-organizational Structures-Executives 136 I. Inter-organizational Structures-Inter-organizational Structures 136 J. Executives-Executives 136 VI.THEORETICAL AND POLICY IMPLICATIONS 136 A. Theoretical Implications 137 B. Public Policy Implications 139 VII. CONCLUSION 142 I. INTRODUCTION

The inability to maintain an effective regulatory and corporate compliance system can be costly to firms and society. (2) Compliance is the set of internal processes used by firms to adapt behavior to applicable norms and regulations. (3) For example, the aerospace giant Boeing is under investigation for its failure to install updated crew alert systems in its recently introduced, and now grounded, MAX 737 jets. (4) The MAX 737 was grounded after two airplane crashes caused the deaths of 346 people. (5) In both cases, contributing factors in these tragic events included failed sensors related to the aircraft's flight control system and an outdated crew alert system. (6) According to Boeing, the crew alert system was not updated to comply with more stringent federal regulations due to excessive costs. (7) This was done despite indicators that the alert system would definitely fail under certain circumstances. (8)

This case, and many others, highlight a critical but often overlooked pattern that has emerged in compliance. This missing piece is the role of information channels or information feedback loops that are necessary to maintain a strong and effective compliance system. (9) In the Boeing case, the first information failure involved corporate governance. Boeing's board of directors was not properly apprised of the company's aggressive managerial culture that prioritized cost-cutting and speed-to-market over aircraft safety and regulatory compliance. Boeing's board has since changed the company's internal reporting structure to directly oversee regulatory safety and compliance issues to avoid these kinds of information breakdowns. (10)

The second information failure occurred under existing administrative law procedures. Boeing avoided notice-and-comment rulemaking by requesting an exemption from updated Federal Aviation Administration regulations related to its aging crew alert system. (11) Adherence to the traditional public notice-and-comment rulemaking process would likely have alerted stakeholders such as watchdogs, competitors, and suppliers of the potential risks of failing to update the alert system. Both types of information feedback loops could have alerted authorities internal and external to the firm and may have helped avoid the fatal crashes. Information feedback loops are vital to maintaining an effective and efficient compliance system and are associated with what is known as a fire-alarm approach to regulation. (12)

The Boeing case is not an isolated example where information feedback loops could have averted a disaster. Wells Fargo, for example, experienced a compliance failure when fraudulent bank accounts were opened for unwitting customers. (13) In that case, information related to this problem surfaced but was internally suppressed. (14) In another case, General Motors neglected public information related to its faulty ignition switch and airbag systems. (15)

In light of heightened regulatory requirements to protect the public, compliance now occupies a central position within corporate law. Many aspects of compliance have become criminalized, leading to what scholars characterize as "a quiet revolution" in corporate governance. (16) Compliance has risen to the foreground concerning regulation, corporate governance, white-collar crime, corporate social responsibility, and ethics since compliance failures such as the one at Boeing have yielded significant, sometimes devastating, losses borne by individuals and society. Other high-profile compliance failures such as British Petroleum's oil spill in the Gulf of Mexico, (17) Volkswagen's emission regulations cheating scandal, (18) and the fraudulent opening of customer accounts at Wells Fargo (19) are just a few of the more prominent and recent examples of corporate compliance failures with high social costs.

Significant strides have been taken to better understand compliance in theory and in practice. The American Law Institute (ALI), for example, has undertaken an important effort to distill the general principles of compliance as an effort that integrates risk management, corporate governance, and enforcement. (20) The ALI's effort distills best practices in a broad array of compliance-related subjects such as the overall governance of compliance and risk management, the board of directors, executive management, internal control officers, and the compliance function. (21)

Scholars have made significant contributions to the field of compliance. (22) Professor Miriam Baer, one of the leading scholars in this area, theoretically conceptualized two principal approaches to address corporate fraud and compliance issues within companies. These include the policing and architectural compliance approaches. (23) The policing approach reduces corporate crime by empowering regulators and internal compliance officers to identify, punish, and deter transgressors. (24) Under this approach, compliance is a command-and-control endeavor with a centralized regulatory, enforcement, and discipline system.

The architectural approach is different since it encourages the regulated entity and corporate personnel to seek out, prevent, and mitigate problematic situations rather than individuals. (25) Compliance is achieved through design and prevention by increasing the costs of a violation or by eliminating the choices that might yield non-compliance. (26) To achieve its goals, the architectural approach emphasizes pre-commitment devices and cognitive psychology techniques, such as nudging, to structure individual choices and eliminate negative biases to prevent a legal violation. (27) A pre-commitment device or strategy involves an actor who has eliminated or reduced the attractiveness of engaging in certain choices. (28) Nudging refers to features developed by a "choice architect" structured within an environment in which choices are made to alter behavior. (29) The purpose of nudging is to deliberately structure choices to help people make better decisions, benefiting themselves and society. (30)

The scholarly literature, however, has neglected a third and vital compliance approach. This article introduces this third approach: The use of information feedback loops within what is known in political science literature as a fire-alarm approach to regulation. (31) Information feedback loops are information conduits distributed amongst the various participants of the compliance system. These information pathways are designed to trigger a response of detection, prevention, investigation, and remediation. (32)

The fire-alarm approach to regulation and compliance advocated in this article is different from the policing and architectural approaches since it relies on different actors and works in an altogether different manner. The policing and architectural approaches focus on the dyadic relationship between firms and regulators and emphasize structural and process-based reforms within the firm to achieve effective levels of compliance. In contrast, the fire-alarm approach relies on regulators, the firm, and external third parties to create a distributed network of compliance-related alarms. The fire-alarm approach is also unique since it incentivizes and empowers these external stakeholders in ways that are not possible under the policing or architectural approaches. In an era of decreased regulatory budgets and industry capture, the fire-alarm style methods of compliance will increasingly be necessary to maintain effective oversight over industry and promote the public aims of regulation.

The fire-alarm approach to compliance also contributes to corporate governance theory, such as the debate concerning the effectiveness of board-level structures versus processes. (33) From a corporate governance theory standpoint, the fire-alarm approach prioritizes company-level processes rather than structures or composition. (34) Information feedback loops rely on effective governance structures and individuals, however, their main emphasis is to deliver information that reduces agency costs and thus are process-oriented. This approach supports the view held by scholars that the most effective forms of governance that reduce the agency costs that arise from information asymmetries result from process-oriented reforms rather than structural changes. (35)

The article will proceed as follows. Part II discusses the...