Crystal Jezierski recently left Walmart Inc. as head of its global ethics program, spanning 26 countries and 2.2 million associates. Jezierski joined Walmart in 2018—highly recruited from Baker McKenzie's Washington, D.C., office. At Baker McKenzie, she was a partner in the firm's D.C. office, where she specialized in white-collar investigations and corporate compliance. She is a recognized leader in program design and governance issues. Recently, Jezierski spoke at Stanford for its Rock Center for Corporate Governance's online series (with former LinkedIn GC and Stanford professor Mike Callahan, and LinkedIn's current head of compliance and integrity, Amyn Thawer).

I caught up with Jezierski to ask her about how to run an ethics program remotely.

RM: Facebook recently announced that many of the company's employees would be able to permanently work from home. Mark Zuckerberg, Facebook's co-founder and CEO, told workers during a livestreamed staff meeting that within a decade, as many as half of the company's more than 48,000 employees would work from home. (The company also noted that some salary adjustments would accompany the change to match local cost of living.) How does this impact a company's culture? In other words, how do you maintain a culture of compliance when you have a remote workforce?

CJ: I agree that COVID-19 accelerated the trend of companies embracing remote working, and I think managing culture will be one of the biggest challenges companies face in doing so.

How companies do this will look different for each company and depend on where you're trying to go with your culture. Are you trying to change a culture? Build a culture? Maintain a good culture?

Companies will need to use different ways of communicating and bringing employees and teams together and be much more intentional about the frequency of communications, with whom, and what you communicate. Ultimately, I think companies will need to overcommunicate about who you are and what you expect from each other. I think companies will also need to give more thought to what values they're trying to promote and what behaviors will further those values. Then leaders will need to be clear, precise and concise when communicating these expectations.

Companies should also be sure to reinforce with their workforce that all lines of communication —with their supervisors, through their business, with HR and compliance, or corporate leadership—remain open. In this kind of environment, it's very important to stay close to all levels of your workforce to ensure you understand how employees are coping in this challenging time and to identify and get ahead of any issues before they get too big.

From an ethics and compliance perspective, do you have any advice for onboarding new employees in a remote working environment?

I would think about what the employee needs to perform their role. What technology—systems, software or hardware—is required for the role? Are their data privacy and/or monitoring issues that should be considered with the new employee? What type of training does the employee need? Two other important considerations are culture and integrating them into your team. As a leader, you'll probably want to stay very close with new employees to ensure those first few days and weeks start off the way you need them to, and, as we've already discussed, being intentional about communicating the company's cultural expectations. Also, we can't overlook that managing a team remotely requires leaders to incorporate new practices and tactics to keep team members engaged while working remotely. You might find that some of your leaders aren't suited to this challenge.

Many corporate leaders have called COVID-19 a "black swan." Although there are news reports that some companies forecasted the virus's global movement faster than others, it seems like most were caught off-guard. Any lessons for how companies should think about enterprise risk?

Companies will need to be much more proactive about anticipating, understanding and preparing for future existential risks to communities and society. As a result of COVID-19, companies reassessed their business models, corporate structures and workforce needs as communities across the world rethought how to come together and live. The impact of these types of events is monumental and the response costly.

I don't think companies can rely on government institutions as they may have in the past. Instead, they'll need to do more to assess for themselves geopolitical, demographic and societal changes globally in order to anticipate future risk. It will require defining risk differently and thinking about what the future might look like in five years. What about in 10 years? How would you want it to look? How do you not want it to look? Which conditions are more favorable or less favorable for your company? How do you want to respond to these scenarios and what business, legal, regulatory and reputational risks are inherent in them?

You managed an ethics program with 2.2 million employees dispersed globally. Do you think companies now have to think about organizational design differently?

Yes. I think they will need to.

First, as companies change parts of their business model, structure and operations to meet changing customer expectations and mitigate risk, the workforce they'll need may change. Corporate functions—HR, legal, audit, compliance—will all need to change as well to effectively support a changing business footprint.

Companies will need to place greater emphasis on human resource management and operational management as they address the new reality around what employees and consumers feel comfortable with. Things like workplace safety, related liability, employment agreements and employee rights will take on increased importance. Union activity and employee benefits are likely to see greater attention. Day-to-day management of a company's workforce will require more leadership than it has in the recent past for most companies.

Meanwhile, functions that performed well may remain remote if there is no business-critical need for them to be in the office, while those that did not may return more quickly. Companies will also need to think about what impact child and family care will have on employees' ability to perform and what kind of support to offer them.

As you think about updating policies post-COVID, what are some key areas that you think companies should focus on first?

First, you have to look at how your company has changed. It may be doing things it hasn't done previously. This will impact the footprint of your program, including whether you have the right people in the right positions—to manage either the transition, being flexible with how we work, or leading in this new environment. This is certainly industry-specific, but, regardless of industry, companies will need to develop a new workforce management strategy. This is everything from how you keep employees safe to what tools employees need to perform their jobs remotely.

How do you take responsibility for effective testing of employees? How do you keep track of that testing activity and results? How do you store those results in a way that protects worker privacy? What about contact tracing and, when a vaccine is available, tracking who has received it?

Employees and companies may have to get comfortable having greater visibility into employees' health status as it may be required to reenter the physical workspace.

The one thing to keep in mind about this is that a compliance program is only as effective as your understanding of what the business is doing and how it's doing it. Companies are continually evolving both of these right now at rapid speed just to survive. So, compliance, but really all the risk functions (legal, audit, etc.), will need to change in order to keep up with this risk. In reality, COVID is testing how well these functions thought they knew their business and operational activities and their assumptions about how best to mitigate risk inherent in those activities.

The Wall Street Journal ran an article recently about post-COVID hospital redesign. Many companies are thinking about their own space—with many having moved to the coveted open floor plan. Some companies, it seems, may rethink this, while others may take a Facebook approach and think more about an agile and remote workforce. Do you think we'll see different types of ethics issues come up in this environment?

We're clearly seeing immense pressure on sales results and that always increases the risk of bribery, kickbacks, collusion and conflicts of interest-related misconduct. Pressure within the workforce to either maintain performance levels or increase performance while in higher risk working conditions or different working conditions can fuel an environment in which working relationships are strained, which can lead to harassment, discrimination and other relationship-based scenarios. Specific to remote working, the integrity of the company's data—so, customer and employee data privacy risks, corporate information and confidentiality, corporate opportunities—is an area compliance programs should focus on, as where data is stored and handled has changed with remote working.

With everyone basically using Google Hangouts or Zoom to conduct investigations, hold meetings, and run their businesses, are we ever going back to live training? Do we need to?

We absolutely need to, and we will. Ultimately, the majority of workers will return to a traditional office. What I think is happening now is companies are recalibrating how to incorporate remote working into their strategy, but I don't think offices will go away. And large, in-person activities will too, but right now everyone is thinking critically about whether all work must always be performed in an office space, and we're learning that it does not. The same will happen with training. That said, training is always more effective in person, both for effective teaching, but, also, for the conversations that occur during and around it. The question will be what trainings need to occur in person, with whom, how and where those employees are gathered, and the frequency.

Do you see any other big changes on the horizon for ethics and compliance?

Companies are operating in a very dynamic environment right now. They are in a continual process of assessing and rethinking their value proposition to customers and how they can provide value to the customer as the customer's definition of value is rapidly evolving. Given that, ethics and compliance functions, and governance and risk management more generally, will need to be much more proactive and remain very nimble and flexible as the businesses continue to evolve to serve customers. Chief ethics and compliance officers need to ask themselves every day—how is my company changing and what does that mean for how our ethics and compliance program needs to change?

Ryan McConnell is a lawyer at R. McConnell Group—a compliance and investigations/criminal defense boutique law firm in Houston. McConnell is a former assistant U.S. attorney with a background in criminal and civil trial work who taught four different law school classes at the University of Houston Law Center (Crim Pro I, II, National Security Law, Corporate Compliance). His practice focuses on advising company leadership and corporate boards on a range of litigation and governance issues. Send column ideas to [email protected]. Follow the firm on Twitter at @rmcconnellgroup.