Let’s talk about pornography.
Personally, I’d rather keep picking about the Securities and Exchange Commission’s fraud charges against Goldman Sachs, or the kabuki theater transpiring in the Senate this week before lawmakers go ahead and approve the regulatory reform bill everyone already knows will pass. But occasionally more interesting news crops up, and such was the case when yet another porn-on-the-job scandal emerged at the SEC late last week.
The broad contours of the scandal are pretty clear: Several dozen SEC staffers have been caught watching pornography at work, rather than doing more productive tasks like preventing the financial crisis. One senior enforcement attorney averaged more than eight hours a day eyeing X-rated websites; another tried to access 1,800 porn sites in the span of two weeks and admitted it was “kind of a distraction, per se.” Yet another apparently watched porn involving under-aged boys and may face criminal charges. Anyone who wants to see a full list of the sites under SEC scrutiny, so to speak, can find it on Gawker.com—although if those sites aren’t work-safe for the SEC, assume they’re not work-safe for you either.
Still, despite all the prurient interest, the compliance community does indeed have a teachable moment here. In fact, we have two.
First, the most alarming news from the porngate scandal is that the SEC has serious internal control failures. One employee apparently circumvented porn-blocking filters simply by plugging a flash-drive into his computer. Another uploaded his own videos onto porn websites using his SEC-issued computer. Exploiting control failures to watch porn is ridiculous enough, but employees could also have exploited those failures to steal financial information, upload a virus into SEC systems, or commit other misconduct. That is what should worry people, starting with the five SEC commissioners. A poor internal control environment at the SEC is nothing new; the Government Accountability Office flunks the SEC on its internal controls almost annually. But the GAO specifically faulted data security controls at the agency in 2007, and this news leads me to believe the problem continues.
Second, three weeks ago the SEC announced the hiring of its first-ever chief compliance officer—and then promptly relegated her to a mid-level rung on the SEC’s influence ladder, where she oversees compliance with SEC rules about which financial transactions employees can or cannot make. That set off a small storm of protest from compliance purists, who complained that a true CCO should have wide-ranging power to oversee all ethics and compliance issues and should answer directly to top management. I agreed with them.
Well, the purists are back again, burning up the messages boards at the Society of Corporate Compliance and Ethics. They rightly note that violating porn policies at work is precisely the sort of ethics and compliance issue a CCO should address, and I agree with them again. Donna Boehme, a former chief compliance officer at British Petroleum and now head of Compliance Strategists Corp., put it best:
The SEC’s focus solely on financial compliance mirrors the same mistake that financial institutions have traditionally made. The result is a non-financial compliance problem that has a devastating impact on the organization's reputation and license to operate. Having an empowered, senior compliance and ethics officer reporting directly to the top would have been one important step to detecting and addressing this risk before it reached the front pages of the news.
Boehme is exactly right. Consider the alternative: The SEC catches and disciplines employees on a case-by-case basis for various policy violations; some lawmaker unhappy with the SEC directs government auditors to investigate the agency; that report is mysteriously leaked to the media at some politically inopportune time for the Commission. Events followed that path here, when Sen. Charles Grassley, R-Iowa, directed the SEC inspector general to study the porn problem—and that report then appeared in the media one week after the SEC’s own suspiciously timed charges against Goldman Sachs, just as the Senate began taking up debate over regulatory reform.
Can we not do better? Really?