Several years ago, in my last term on the NCAA Division I Committee on Infractions, I was listening to a university president try to explain how his athletic program landed in trouble, despite having pretty good compliance systems and people in place. It struck me that I had just read similar explanations while pouring through a number of corporate representative depositions in securities fraud cases; I was working as an expert witness for investors who had lost millions in health care fraud. In both the NCAA and securities cases, some of the CEOs thought they had all the compliance bases covered, with impressive programs on paper and adequate staffing, based on industry norms.

Despite the differences between university athletic compliance and corporate finance, the features and failings in the cases were strikingly similar. At the NCAA hearing I pulled out a legal pad and wrote eight bullet points describing parallels in compliance failings between the NCAA and business corporations.

With only minor stylistic changes, those points remain unchanged from the list I made that day. You can take every observation in the list and turn it into a lesson on how to avoid the negative outcomes in the NCAA and securities cases.

• Once you get past a certain institutional size, most organizations have fairly impressive compliance programs – on paper. The record of compliance education and monitoring is usually strong. Most actors in NCAA cases and in corporate depositions do not complain of a lack of effort or process in rules education.

• Process is a critical threshold and first step, but the integrity of people matters more. Many of the failings are in people, not process.

• Most failures and frauds are the result of people being pressured to meet unrealistic expectations or goals. Whether it is reaching too far to land a recruit, stretching to meet a sales quota, or reach a Wall Street earnings projection, it is the long reach that will get you.

• A smart, determined person usually can subvert or circumvent an impressive compliance system. In both college sports and business worlds, institutions are frequently harmed by intelligent bad actors, who find a way around a monitoring system.

• Some determined wrongdoers are not deterred by the threat of penalties or the possible loss of their livelihood. It is hard for prosecutors and sanctioning bodies to admit, but sociopaths cannot be your target audience in formulating a penalty structure and imposing sanctions. If the institution has done a credible job in the compliance area, do not mortally wound the institution because you cannot lock up or shame a sociopath.

• The most effective compliance program will fail if a person in a leadership position blinks. If a corporate CEO or university president or athletic director sends a “wink and nod” signal across the organization that non-adherence will be tolerated, people in the compliance office do not stand a chance.

• Often the most significant damage comes not from the initial misstep, but from the cover-up. What otherwise would result in relatively minor damage balloons into a major fraud and career-ending move.  Failing to be straight up when an investigation is underway can invite the worst consequences.

• Mistakes happen.  Everyone makes them.  They are not necessarily a reflection or your character or reputation unless they become a habit. People of good will, whose opinions matter will understand that. What they will not understand and countenance is a cover -up.

CONCLUSION

In both industry and on campus, millions of dollars are being spent on compliance.  No matter how different these worlds appear, I learned, they have a great deal in common when it comes to compliance failures that undermine that investment.