Compliance failings: Oxfam and other industries (part three)

Compliance failings: lessons for us all from Oxfam and other industries (part three)

In the third and final instalment (read parts one and two here), Legal & Compliance expert Keely Hibbitt works with Safecall to set out how, in light of Oxfam’s compliance failings, organisations of all types should be reviewing their compliance and whistleblowing programmes and most importantly, driving cultural change within their organisation.

Strategic programme review

Programme review.  The Commission found limited evidence of information being used to drive the effective management of programme. They found a gap between the programme’s strategy, the strategic intent behind it and its implementation.

The direction and strategy of a compliance programme, in addition to its operation, should be reviewed periodically.  The programme itself should be updated as the organisation and the risks its faces change.  The process for reviewing and updating the programme’s strategy should be documented and where appropriate, communicated.

Resource for a proactive approach.  The Commission found that Oxfam GB’s organisational approach to safeguarding and the limited resources of the team meant that it was almost exclusively occupied in undertaking reactive case work with very little time dedicated to proactive strategic, thematic or preventative work.  Oxfam GB has since quadrupled the team’s budget and doubled the size of the team. 

How well resourced and whether resource has ever been turned down is one of the key areas of focus in the Department of Justice’s recent guidance on the questions they will ask during an investigation.  Whilst asking for budget is never a welcome conversation, it is incumbent on the person responsible for compliance to ask if there is a genuine need, particularly if this enables the team to undertake preventative and longer term strategic work.

Culture change

Lastly but most importantly, culture change.  The Inquiry was clear that what is required is not just putting in place policies and procedures: culture improvement must be embedded through the day–to-day actions and behaviours of trustees, leaders, staff, volunteers, contractors and partners. Good behaviours must be role modelled from the top and across the network. People who call out poor behaviour need to know they will be supported at all levels.  This has been acknowledged by the current CEO of Oxfam GB:

“The changes we need to make at Oxfam are both systemic and cultural. They include our policies and practices….. But they also include our attitudes and behaviours. We need to make a concerted, explicit effort to deconstruct the power inequities that are all too easily built into, and perpetuated by, institutions like ours.”

Whilst cultural change takes time (and the sufficient level of support), it is the only way to successfully embed an effective compliance programme within an organisation.  Like most problems, the first step is to understand what the current culture is and agree what it should be.  Only then can a plan to get there be created.

The final thing to note about the Commission’s findings is that in the areas mentioned above they found that the administration of the charity had been mismanaged.  This was not as a result of the operational performance of the charity in carrying out its charitable mission but due to the behaviour of its staff and how it responded. This demonstrates that where culture fails, so does the organisation.

Creating a strong culture of managing risk and compliance in a proactive and holistic manner has never been more important.