Edward Hanover, Chief Compliance Officer with FIFA. July 10, 2017.

Goodbye 2018 and hello to 2019. As we strive for continuous improvement in our personal lives, the new year brings with it New Year's resolutions. Less screen time, more fitness, more travel, become a better person. There are endless possibilities. But what about work goals? How do we view 2019 as an opportunity to make our business better (which helps everyone)?

For sports organizations, compliance is low-hanging fruit. The new year offers an opportunity to better understand your organization and introduce program enhancements that can ensure program effectiveness. Here are five that you probably should have done last year. But better late than never…

• Understand risk.

This should have been done already, but, as the saying goes, the best time to plant a tree was 20 years ago and the second-best time is today. Conduct a compliance risk assessment. This will be the cornerstone document for how you build your program. Start the process now and you will not regret it. You will learn about your organization and will be better positioned to manage your risk. Do this periodically (annually is best). You need to know your business, and this forces you to learn the business and consequently understand the risks. For sports, ticket sales are always an area to focus on, so this could be a good place to start.

• Implement a hotline (that allows anonymous reporting) and test it.

We have seen enough truly unbelievable examples of pervasive sexual harassment and assault at media and sports organizations to recognize that a problem exists. There's no guarantee that a proper system would have prevented these egregious events, but what if these organizations had a whistleblower hotline and reporting system that worked? What if they trained their employees on such a system and built up trust to ensure employees that they would not be retaliated against for reporting misconduct? If they had this, would these events have happened? Or would questionable behavior have been discovered earlier? We shouldn't need nearly $500 million in potential settlements by Michigan State University, the bankruptcy of USA gymnastics, or the scathing Rice report to see that there is a clear and present risk to an organization, their employees and stakeholders if they do not effectively implement a hotline. Sports organizations are also typically “small” so spend enough time socializing the hotline and building trust that it really is anonymous.

• Learn who we are doing business with.

This is obvious, but we consistently hear that third parties are the biggest risk facing our organizations. But how many media companies or sports organizations have implemented a written due diligence program? How many of these organizations have an idea of the number of third parties they deal with? We all know this is a risk, but many have not implemented a due diligence program because they have other “fires” to put out. Start with a risk-based process to determine the universe of your third parties and categorize them. Then establish a process to conduct due diligence on new third parties and an annual process to conduct due diligence on your existing and “higher-risk” third parties. Specifically in sport, we are often dealing with numerous consultants. Meet with the various group heads in your organization to see how many employees they have versus how many external contractors they are using.

• Embrace the Twitter generation.

Perhaps this should be number one. Boring and ineffective training is one of the biggest challenges compliance programs face (and organizations in general). It is typically an afterthought and not tailored to the organization. Training is an opportunity to impress and embed what we want our organization to be and the culture we want to embody but it is consistently underwhelming (or at worst, a waste of time). When was the last time you had a corporate training and said “that was time well spent?” We can, and should, do better. Compliance should be an interesting topic. The Twitter generation expects things to be simple and easy to understand (and 140 characters or less). If your employees and stakeholders know what is expected of them and know where to go with questions or concerns, you may not need to have such detailed policies and procedures. Short and concise is the new gold standard for the Twitter generation. We are lucky that in sports organizations we have a “cool” topic to teach with. Try to enlist support from the sports side of your organization to deliver the message.

• Put ourselves to the test.

Elite athletes perform when the lights shine brightest. You don't know if you are ready and prepared unless you are truly tested. Nick Foles faced down Tom Brady and the New England Patriots in Super Bowl LII and will forever be a Super Bowl MVP. You need to test your program to make sure it is really up for the task. Do you have any complaints on your hotline? No? You should find out why because that is not necessarily a good sign (see above, do you even have a hotline?). I cannot overestimate the importance of testing if your hotline is “working.” You should have complaints to follow up on.  If you do not, it isn't working.

I look forward to a productive 2019 and leave you with a parting thought: a well-designed and implemented compliance program is a competitive advantage. I am an absolute believer in this. If your organization can focus their efforts on putting together a Super Bowl-winning team or Oscar-winning movie, as opposed to spending their time managing claims of pervasive sexual assault or claims of kickbacks, then you have done your job. Focus on adding value and your stakeholders will come to you for support.

Edward Hanover is FIFA's chief compliance officer. He joined FIFA in 2016 as FIFA's first chief compliance officer after a lengthy career as a general counsel and senior compliance executive in the pharmaceutical industry, with positions in the United States, Europe and Asia. Contact him at [email protected].