David Huntley did not set out to become the chief compliance officer of one of the biggest wireless carriers in the world. At the 2019 Global Ethics Summit he spoke with Corporate Counsel about built-in versus bolt-on compliance and how he's helped to make sure everyone from the top down views compliance as personal responsibility.

This conversation has been edited for length and clarity.

Corporate Counsel: Could you explain your role at AT&T and how you came into that role? 

David Huntley: I'm responsible for safeguarding customer and employee information and verifying compliance of all rules and regulations wherever we do business. I also have a responsibility for accessibility which is another important initiative for our company as well.

Our CEO and chairman chose me for the role. It wasn't anything that I set out do. I think he chose me because I have a varied background with many different experiences. I started as a lawyer for the company. I then transitioned out of the legal department and to run different business units. I then came back into the legal department as the general counsel of our Yellow Pages business. From there I had other legal roles. I think what happens is it's probably prepared me for this role in compliance because I know what the leaders of the business units are up against. I know what it's like to be in a competitive environment and I also know the importance of the rules and laws having been a lawyer.

CC: Do you find that you often have to emphasize to executives the importance of compliance?

DH: It starts with their making sure it's their responsibility. It's not my responsibility to simply tell them. It is their responsibility to know what those laws, rules and regulations are. It's my responsibility to see how they go about that and to help them do what they need to do.

I think that's what sets a good compliance program apart from others is that it isn't the compliance organization's role to own compliance. It is for the business to understand it and own it.

CC: Explain the importance of a company having a built-in compliance policy as opposed to a bolt-on compliance policy.

DH:

DH: Think about it in terms of knowing that there are rules, regulations and policies designed to help the business operate within the law. While the business is focused on placing products and services into the marketplace, we need to do it with a lens of compliance at the outset. This is what we call built-in compliance. Bolt-on compliance means that you put a product or service out in the marketplace, then you have to now figure out how to make sure that product or service is in compliance with the law. A bolt-on approach can be costly. Making compliance a secondary concern may result in having to redo the product or redo the service in a way to that ensures it is fully compliant with the law. Not only can this increase costs and reflect poorly in the market, it can also result in fines and additional oversight from regulators. This reminds me a of an old John Wooden quote: “If you don't have time to do it right, when will you have time to do it over?”

Let's look at this from an accessibility standpoint. There are rules and regulations that we must abide by when designing a product. Sometimes when we design things, we neglect to consider how that product can be used by all people. We don't think about how we're going to make the product accessible to people with hearing or sight limitations. What my team is designed to do, and what the law says is required to do, is to think about people with these issues. Oftentimes, doing this results in creating a better product. I like to say that it's not just about complying with the law, it's about complying with the spirit of the law. What the law was designed to do is make sure that people with impairments have a chance at being able to consume a product the way anybody else can.

I say it to people all of the time, if you just keep living, you will have an accessibility need. Our sight is going to go. Our hearing is going to go. Our cognitive ability will go. That community is us. That's what I mean by building in compliance and demonstrating to regulators that we don't need rules for every little thing. We don't need a lot of regulation. We see what you're trying to get at and it makes good business sense.

CC: Can you take me through the hands-on compliance training you've developed for AT&T employees?

One of the things we've tried to do is make our training much more dynamic instead of static. Most people think of compliance in a way that means they've checked the box and then moved on. What we wanted to do was put tools in the hands of our employees. Tools that allow them to manage their ethical responsibilities and obligations and not in the sense that it is an afterthought. The example that I start with is our code of conduct. We made it web accessible so you can take the training anywhere. The second thing we did is add a decision tree into the code so that you could query this application on your own. We found that when we first launched it, about 30,000 people asked questions about conflicts of interests. Then another 27,000 to 30,000 people asked questions about accepting gifts. We felt that was a touchdown because we have people engaged with this thing on an ongoing basis.