For many corporate counsel, "culture" and "compliance" seem to be mutually exclusive concepts.

Culture is squishy and conceptual. Compliance is definitive and measurable. Follow the seven steps in the Federal Sentencing Guidelines, and, voila, you have a compliance program. Why would corporate counsel even have to bother with the whole idea of managing their company's culture? That's an HR issue.

But the world of compliance has changed, and chief legal officers are actively learning how to manage this new reality.

Compliance programs have proliferated since the enactment of the Federal Sentencing Guidelines and the landmark 1996 Delaware Chancery Court decision In re Caremark. But the promulgation of compliance programs hasn't led to less compliance violations and ethics scandals.

As noted by corporate governance expert professor Charles Elson: "Under Caremark, boards were required to ensure that appropriate legal compliance mechanisms were established by the corporation. The result was a rush to create vast compliance programs that may have acted to limit a director's (and a corporation's under the Guidelines) potential liability, but did little to create a climate within the organization that ensured responsible and ethical behavior."

We can't forget that Enron had a code of ethics. And it wasn't as if WorldCom didn't have extensive internal controls. But both had cultures where engaging in unethical conduct was tacitly condoned, if not encouraged.

The focus has shifted clearly towards looking at what is going on inside organizations that is either keeping people from doing the right thing, or, as importantly, keeping people from doing something about observed misconduct. The data confirms this trend and the regulators and prosecutors are responding.

The Ethics Resource Center recently released the 2005 National Business Ethics Survey (NBES), which clearly confirms the trend towards recognition of the role of corporate culture. If an organization wants to reduce the risk of unethical conduct, it must focus more effort on building the culture than on building a compliance infrastructure.

Based on interviews with over 3,000 employees and managers nationwide, the survey disclosed that - despite the increased implementation of ethics and compliance program elements - desired outcomes, such as reduced levels of observed misconduct, have not changed since 1994.

Even more striking is the revelation that while formal ethics and compliance programs have some impact, it is the organizational culture that has greater influence in determining program outcomes.

The SEC and the Department of Justice have been watching these trends as well. Stephen Cutler, the recently retired SEC Director of the Division of Enforcement, was matter of fact about the importance of looking at culture when it came to decisions of whether to bring an action:

"We're trying to induce companies to address matters of tone and culture. What we're asking of that CEO, CFO or General Counsel goes beyond what a perp walk or an enforcement action against another company executive might impel her to do. We're hoping that if she sees that a failure of corporate culture can result in a fine that significantly exceeds the proverbial 'cost of doing business,' and reflects a failure on her watch - and a failure on terms that everyone can understand, the company's bottom line - she may have a little more incentive to pay attention to the environment in which her company's employees do their jobs."

Making it Happen

How do you it? Where's the best place for a corporate counsel to start in assessing the impact of the company's culture on the ability of their company to stay out of trouble?

Only lagging companies still measure the success of their ethics and compliance programs only by tallying the percentage of employees that have certified reading the Code and attended ethics and compliance training.

The true indicator of success is whether the company has make significant progress in achieving key program outcomes. The National Business Ethics Survey listed four key outcomes that can be used to determine the success of a program: