Full Interview | Matt Pachman

My name is Matt Pachman. I am the Chief Risk and Compliance Officer at FTI Consulting. We are a global consulting firm.

I started my career after graduating from the University of Virginia Law School in 1991. And went from there to a federal appellate clerkship and then on to work for a large international law firm, O'Melveny & Myers. I left O'Melveny to go in-house to practice law at a company called MCI, which is a telecommunications firm. MCI was later purchased by a company called WorldCom and WorldCom was owned by a man named Bernie Ebbers who later went to prison for ethical violations. It was at that point that the company came to me and asked me if I could start an ethics program at the company as it emerged and tried to reform itself. I worked at FTI for a couple of years. FTI is where I work now. I was in that role at MCI for a couple of years and then transitioned on to another company that had had some issues and that was Freddie Mac. And I helped build Freddie Mac's ethics program and I spent about six or seven years there. And then I got a phone call about becoming the chief ethics and compliance officer at a pre-IPO privately held company called Altegrity. And I went and I worked with them for a couple of years setting up their program and ultimately transitioned to where I am now at FTI. What is FTI Consulting? FTI Consulting is a global consulting firm that helps businesses with their critical issues whether they involve how to structure and run their business, whether they involve how to find their way through litigation, economic type issues and strategic communications, crisis communications, things like that. What is FTI? The acronym for FTI is irrelevant. That's not a good answer. I don't think I can make it that way.

It was interesting moving from a law firm in-house to begin with. There's a certain culture shock that goes along with that because the politics are different. The way you are judged on the quality of your work is entirely different. How you respond to superiors is different. And that was an adjustment in and of itself. But when I was asked to be the chief ethics officer, that was a real change. Because while ethics and compliance absolutely have a legal element, and I think a legal background can be extremely helpful, it is a different way of looking at the world. And to be a strong ethics and compliance officer, you need to be able to make that shift from thinking like a lawyer to thinking like someone who is responsible for a program. Someone who is trying to achieve something from a programmatic perspective. And it is a big shift, and I've seen a lot of people have trouble with it. And it's something, quite frankly, that you can't teach so much as you have to experience it over time and take counsel from people who have been through that process.

I think the biggest challenge in shifting from being a more traditional practicing lawyer to being a practicing ethics and compliance officer is how you view risk. That is, the typical lawyer is like the policeman on South Park who says, hey, nothing to see here, everybody go away, there's nothing here. Whereas the compliance officer and the ethics officer have to say, okay, let's find the problems. Let's shine light on the problems. Let's let everybody know what those problems are so that they don't do them again. It is a very different way of approaching the world and it's a hard shift to make. It's like jumping off a very tall diving board. And then once you do it, you can get more comfortable with it. But it's not the way you were trained as a lawyer.

Transitioning from being a more traditional practicing lawyer to being an Ethics and Compliance Officer was talking to people who were knowledgeable about this new field. And the first place I went was the Ethics and Compliance Association, which was then the Ethics and Compliance Officer Association, or the Ethics and Compliance Association has changed a few times. And I sat down with Carrie Penman at the ECA, and she was very helpful walking me through all of the different elements of a good Ethics and Compliance Program. And it was both the mechanical functions and the day-to-day things that I might expect. And that was pretty critical. But I'll also say that the person that really helped me the most was a woman named Linda Lips, who unfortunately has left us. But I called her, I cold called her from the ECA directory. And I did it because we had an issue where I wanted to talk to somebody from a firm that had been in trouble. And Linda was with Waste Management, and I knew they had been in trouble. And I'd never met her before, and I called her. And I asked her the question, and she answered it, and then she said, how long have you been doing this? And I think I told her probably about two weeks at the time. And she said, tell me about what you're doing. And I did. And then she said, let me help you out. And about two hours later I told her I needed to go home to my family, and I was getting writers' crap from taking notes. A month later I was on a plane to Houston. And she had me down at Waste Management, and she and her team walked me through everything they did during the day. And it was that kind of support that was critical. And I found that kind of support from then to today among members of our profession. It's one of the great parts of our profession, is that we're all there to help each other out. And you can ask questions. Back then I think it was even more critical because there wasn't all this information that was out on the web that you can reference. There were a lot fewer people writing about it. But it's still the same today, really. It's calling someone up, and you can hear in their voice that they understand the panic that you're feeling, or the weird question that you think that no one has ever addressed before, and they're able to help you work through it or talk you through it. It really is an amazing thing.

You know, I can't remember, sorry. I have received some weird questions over the course of my career. And some of them my colleagues have been helpful with, and others I've had to struggle through myself. One of my favorites was one of our people at a prior company called me up and said he had been out on an entertainment trip with some vendors, and the trip was a fishing trip. There was nothing wrong with the trip. It was fine. He got back, and a couple of weeks later he received in the mail a large package, and it was a stuffed fish. It was one of the fish he had caught. It had been stuffed and mounted by the vendor. And he wrote me a note, and he said, my guess is that this probably cost more for them to put together than our gift policy allows. Having said that, it's a stuffed fish that I caught. What's the answer here?

Well, my answer to that question, I think, was that we let him keep the fish because it didn't have a market value that was particularly high. But what really was going through my head was, when I graduated from law school, I did not think that I would be answering questions about whether or not one can keep a stuffed fish. And this is where my career has taken me. I'm sorry.

No. Oh, you were there before the fall, so to speak. Well, I'm now not speaking to the camera, so I'm going to look at you. I came over and was a practicing lawyer at MCI. Bernie bought MCI. I was that and then I got drafted after Bernie. Yeah. That's okay.

So people often ask me about being the first ethics officer at MCI after the WorldCom debacle and how this came to be. And it really went like this. I learned about the allegations of fraud the same way most people did. I saw it on television the night it was announced. And obviously the next day in the office was an interesting day. At the time I was still doing litigation and administrative law for that company. And at a certain point the phone rang and it was the general counsel and he asked me whether I would be willing to become the new ethics officer for MCI. He said apparently companies have such things and we should have an ethics program. And he told me I'd be reporting directly to him and working with the CEO and the board of directors and that was obviously an interesting challenge for me. And that's how I got into that position. Now fortunately for me I didn't have a lot to do with investigating the fraud that everyone knows about. There were teams and teams of outside lawyers and investigators that were involved in that. But as you might imagine there was a culture at what had been WorldCom that was not a very strong culture when it came to ethical behavior. And there were a lot of things that weren't in the news that required cleanup. They weren't as sexy, they weren't as troubling to the rest of the country, but they involved minor things like petty fraud and things like that. And those were the kinds of things that I had to investigate. The investigations of those things are somewhat straightforward, but this is where I really learned about the importance of culture and culture change and the role of the ethics and compliance officer in culture change. Because the role is not just about being the vice principal or being the cop, far from it. It's about saying, okay, how am I going to take a group that may have had a bad tone at the top, may have had a not particularly healthy culture and turn that around. And that was a big challenge. And I'm not going to pretend that I did that by myself. I had a lot of help and the people that came after me did a lot more to bring that forward. But that was one of the more interesting parts of that job and quite frankly, in terms of my own personal development in this role.

People sometimes ask me whether it was scary being the first chief ethics officer at WorldCom slash MCI. And the answer is yes in some ways, but not in the ways you would think. Most ethics and compliance officers, the real fear that they have is something that blows up on their watch. And in my case, that wasn't what was happening. I was coming in after the wrongdoing had been revealed. And so I was doing more cleanup work. What was more frightening in those days was trying to figure out in a huge company that was going through this firestorm that had investigators everywhere. That had everyone from lawmakers down to consumers furious at the company and the people that worked for the company even if they were innocent. That was scary because who knows how to deal with that situation? Who knows what the right answers are? And it was difficult working through that and there were a lot of times that were very disconcerting for me as a newly minted compliance officer going through fire trying to build a program at the same time that the train was both moving and on fire, if I can mix my metaphors. It was a difficult time in that sense. Very challenging.

People often ask about your role as the compliance officer and how much support you get. Is a company like MCI WorldCom one where they don't support you and are there others that support you better? And the answer is you do get different levels of support but for me, as the first compliance and ethics officer at MCI, there was a fair amount of support because of course everyone knew we had just gone through this terrible event and I think most of the employees were thinking yeah, the whole group needs a shower if you will. When you're appointed after a crisis, there's a little bit of wind beneath your wings. The challenge I think for me in that role was that nobody in the company was familiar with what this role does and so understanding just how much support and just how many resources it might need at a time when it's cutting back because it's facing bankruptcy, that's a challenge, right? Where people I think are philosophically supportive but they're not sure exactly how to deal with things mechanically. I've worked at other places where leadership is very, very strong in terms of culture and wanting to promote it and then you get a great deal of support and a great deal of air time and I've worked at other places where it's definitely the role is seen as a check the box function. We need one of these roles. We need an ethics officer so we're going to hire one and sure we're fine, go ahead and put in place the code of conduct, put in place certain other things but the degree to which we're going to support you is going to be limited and those of course are the harder ones to deal with. I've never worked anywhere where management is outright hostile to the function. I think where management would be hostile to the function, the function's not going to exist for the most part but there is a degree of whether it seems a check the box exercise versus really a role that contributes to the growth and health of the firm.

When I think about what makes the difference in a leadership group, about whether they really are supportive of the program, a lot of times it's a gut feeling. I think there are firms that will throw money at a problem and that's always good but that doesn't necessarily mean they're true believers. It really comes down to when you're going into the CEO's office, when you're going into the GC's office, when you're going into the office of the head of HR and you say, hey, I just received the following report, how do they react to that? Is their reaction, okay how does this work with our culture? What do we need to do to address the situation appropriately? And by the way, simply saying off with their heads is not necessarily an indicia of being supportive. What's being supportive of the program and really understanding the program is being thoughtful about it and saying, okay, what do we need to do to promote our healthy culture in light of what I have just learned?

Yes. The financial sector as a whole. You talked a little bit about relationship building with SeaWorld and could you talk about any relationships with board members of governance and certainly regulators who are very interested stakeholders. How in your roles did you interact? Did you have a few influence to learn? What was that like? I've had a number of opportunities throughout my career as an ethics compliance officer to deal with regulators and different types of regulators. More generalized regulators like the ones that I would deal with at a place like a Freddie Mac for instance, there was a really important educational role for me to play. And it was interesting. I think at that time because the role of ethics compliance officer was new regulators would come in and they'd want to go over your docket which was fine and expected. But I think there was an expectation on their part that there would always be some major crisis or major fraud that was going to be in your logs. That's what ethics and compliance officers do and that's what comes in on helplines and hotlines. Somebody's committing fraud. Somebody's doing something terrible. And there was always this educational piece of saying, actually a lot of the stuff that comes in, the vast majority of the stuff that comes in is more plain vanilla. It's more basic human resources type issues or a small issue involving a policy violation. But nothing is particularly sexy and yet you have to deal with all of those as if they're as important as anything else. And getting the regulators to understand that that's sort of the status quo and then developing with them and understanding that you are going to communicate with them appropriately when they really need to know something and earning that trust. That's a critical thing to do. And understanding the balance in that relationship. The other thing is to think about what is it the regulator needs from you beyond understanding how your role works. What kind of documents, what kinds of information do they need in order to feel comfortable? It's the same kind of analysis in some ways that you go through when you're thinking about what does my board need to know? The information may be slightly different but it's a similar kind of analysis and a similar kind of thought process.

The role of Chief Ethics and Compliance Officer is an interesting one because one is often asked about the independence of that role. And can you do what you need to do or are you under the thumb of management? And in some ways I think people misunderstand what independence means. You absolutely need to be in a position to stand up and say I see something that's wrong here that needs to be fixed. And if you have to, take that all the way up to the top of the organization. But that's not how I really view my role on a day-to-day basis. The way I tend to explain it is, I'm like the guy who sells you burglar alarm services for your house. I'm going to go into your house. I'm going to look around. I'm going to see all the places where things can go wrong. I'm going to look at the windows. I'm going to look at the doors. I'm going to look at fire risks. I'm going to look at all kinds of things and look at where things can go wrong. And then I'm going to tell you how you can minimize the risks of those things going wrong. And I'm going to show you how you can do it. And in many cases, I'm going to do it for you when it comes to drafting policies and other things. In other places, I'm going to talk to you about how you can make your house more safe. And the point of that analogy is, I'm working with you. I'm not, you know, I'm independent but I'm not an outside regulator. I am not the vice principal. I'm succeeding if my entity is succeeding. I just believe the entity is going to succeed better if we operate in an ethical and compliant manner.

Am I part of management or am I independent from management? I would say that I'm part of management. I don't think that that necessarily means that you can't be independent. There are ways in which you can help build something and build a business so long as you and everyone else know what your responsibilities are with respect to your role. And in my case, that means independence. In my case, that means if I see somebody doing something wrong, if it comes to it, I've got to go straight to the board and I've got to say something. That doesn't mean that I have to be separate from management and can't work toward building something. And I think that's an important thing to understand because if you get too far on either side of that, I don't think you can do your job well. And you see a lot of people getting on one side or the other, right?

I think when we talk about balancing, being part of management, being independent, I think today, more and more ethics and compliance officers understand how to strike that balance. But I still hear stories about people who view themselves as the police force or where their first answer to everything is no because that's easy. As long as you say no, there's no risk. And there are nightmare stories about that from people in our profession. But I think that's the exception rather than the rules we see here today. I think more and more people understand what their role is and that is helping the business or the agency or the non-profit to grow by fostering a healthy culture.

In my current job at FTI, my title is Chief Risk and Compliance Officer. And that sort of begs the question of what is risk. And of course we could talk for hours about the definition of risk and compliance and ethics. But I think really what it means for me in my role is where could things go wrong, particularly in an ethics and compliance role. But I also, in my particular job, I'm responsible for our major insurance policy. So I need to know where things can go wrong from an operational standpoint as well. I have worked in places, like when I was in Freddie Mac, where there are huge departments that are dedicated just to operational risk and just to credit risk and things like that. And so different companies are going to define that word risk and staff that issue differently. And different companies are going to stack the reporting relationships between legal and risk and compliance all differently depending upon where their pain points are.

What's looming on the horizon? Ethics and compliance officers are routinely asked what's the next thing coming, what's the next thing that we have to worry about. Right now as I sit here in 2020, I think many of us are consumed with privacy type issues. The privacy laws are changing so dramatically in Europe and in the United States and elsewhere that the chances of someone violating something there and there being a significant fallout from that are tremendous. So that does seem to be the biggest risk right now. Having said that, again sitting here in 2020 we just heard about the Houston Astros baseball scandal and the players who were cheating and calling out pitches. And that's just traditional bad ethical behavior. It's famous because of who did it, but it's traditional bad ethical behavior. So I cannot sit here and say we should only be looking forward to see what the next thing is because unfortunately the old stuff is going to stay with us too. And that is the real challenge, is that nothing ever seems to fall off the table. We may get a better hold on it, we develop better controls to keep things in line, but all the old problems tend to find a way to resurface and you can never, you know, you have to keep your head on a swivel all the time because you have to be looking forward and looking backwards.

CSR, or corporate social responsibility, is an issue that raises its head a lot now. It's an incredibly important thing for corporations and other businesses. The question of whether it should apply to or be in the realm of the ethics and compliance officer is an interesting one. On the one hand, I might say no, it really is about people and it is closer to a human resources issue or an issue that's just dealt with by management generally. But, a good CSR program can be really important in influencing culture overall. How do we, the employees of our enterprises, think of what the role of our enterprise is in the community? That makes a big deal for purposes of culture and that, of course, can affect ethics and compliance. So the concept of an ethics and compliance officer simply saying CSR isn't mine, I think is short-sighted. Whether CSR should report to the ethics and compliance officer, I think that's a more complex question. Is that okay?

There are a few things in my development as an ethics and compliance officer that really change the way that I did my work and influenced me. One is very simple and basic and happened early on. It was the very first internal investigation I ever had to work on. Without going into the specifics, the bottom line was that the wrongdoer had actually sent a request by email to an underling asking the underling to do something unethical on her behalf. And the underling called it in to me and we had this person dead to rights in an email message. And I confronted her and we were getting ready to fire her, it was that type of offense. The mistake I made was it was so clear cut that I was ready to go and just say, we're done. We got it. And yet what we later found out was that the activity being engaged in by the wrongdoer in that case was being engaged in by a lot of other people in the same business unit. And I almost missed it because I thought it was so clear cut. And what I learned was you really have to look at everything that comes across your desk and think, how might this flow out? Nothing is particularly cut and dried until you've really chased all the threads to the end and turned over all the rocks.

Eye opening moment for me as an Ethics and Compliance Officer, but really as a more senior professional or someone who is transitioning into the role of a senior professional is understanding what my role is and how to play it. It's very important for an Ethics and Compliance Officer to be able to go all the way to the top if they have to to deal with an issue of wrongdoing. Having said that, that doesn't mean that you are infallible. And there are going to be times when there are people senior to you in an organization who think differently than you or approach things differently than you and it is not your role to say, no, it must be my way. It's your role to say, okay, what is the way that I can work with this particular person, again, assuming that they are an ethical person and not doing anything unethical, how can I work with them to achieve my goals as opposed to trying to force my way on that executive when I'm not the only person in the company?

Do you want me to reference Mike in my answer? There are a number of people in our profession, including the late Mike Hoffman, who was a great mentor of mine, who believe that the Chief Ethics Officer or Chief Compliance Officer should report directly to the CEO. And there's a lot of reasons for that. One is to show how important the role is. Another is to make sure that the role is not critical. Another is to not have that person's voice adversely affected by the General Counsel or somebody else who actually plays a different role in the company. And probably the majority of Ethics and Compliance Officers agree that that's the better form. I don't disagree that that's the better form, but I tend to be in the minority in thinking that it's not critical. What I do think is critical is access. For me, with my CEOs, if I walk up to their door and knock on the door and they see me and I have a particular look on my face, they wave me in. If I have that kind of access to the CEO, if I have that kind of access to the Chairman of the Audit Committee, I'm not worried necessarily about my administrative reporting relationship. If I don't have that access, that's a real problem. And again, you can't always, unless you structure things that the Ethics Office reports directly to the CEO, you can't guarantee that kind of access. But that to me is the more important way of thinking about it. Can you be heard and are you being heard?

From the very beginning of my tenure as an Ethics and Compliance Officer, I got involved with what was then the ECA and is now the ECI. And it has been absolutely invaluable to me to be a part of an organization like that. From the beginning, it was the organization who taught me the ropes, who taught me what are the basics that I had to do. And then when I started going to conferences, just being with fellow travelers was so important. Every six months or more to sit with people who were going through what I was going through, where I could compare notes and really be in a safe space. And that was so important to me. And it was the only place at that time that you could go and learn about some of the developments in the industry. Because again, I'm talking about 2002 to 2004, the internet wasn't then what it is now. I think as we have developed as an industry, there are more sources of information and that's a terrific thing. But I still find that the associations are incredibly valuable to keep us together, to give us a voice, to sorry, I had another thought. It just left me. Keep us together to provide support to the associations that give us a voice, that give us a presence. Helpful, especially for you at the beginning of your career.

That was what I was going to say. I mean, I think that today, associations of ethics compliance continue to be valuable. They've changed in some ways because the basic information is much more easy to obtain and because there's more people in the profession strewn about various companies, so very few people are now starting from scratch. What they do now though is they help you to dig deeper. They provide you with resources to deal with the much more complex problems than we used to deal with. They are able to deep dive into things like the psyche of the American or the global worker to figure out what drives people, including what drives them to behavior that may be inappropriate. And that helps us to get out in front of things. Some of the data work that's being done now that not only can help you prove the ROI of your program, but actually may be able to help you spot problems before they become bad problems. This is incredible stuff and that is going to come out of these kinds of associations and vendors and others that have grown up in the space in the last few years.

Explain that second one to me.

I'm often asked by people who want to join the profession first of all, how can they enter it? And second of all, what should they look out for? On the first question about how to enter the profession, I think that's, it's difficult because while there are starting to be university type courses in ethics and compliance, those still are at the margins at this point. So the concept of coming into a company right out of school and going to ethics and compliance, while not unheard of, may be more difficult. It's also helpful to have some experience in an organization in order to really do ethics and compliance because it's helpful to understand how organizations work. Having said that, it's not impossible and there are rules for everybody at all levels. Now the question about, you know, what can I, what should I avoid? How can I avoid some of the real traps if I become an ethics and compliance officer? Well, the big thing is you can't do it alone in your office. You need to go out and socialize, not necessarily outside of work, but socialize with some of the critical functions at all levels that you're going to have to deal with and rely on. You need to know the people in human resources. You need to know the people in finance. You need to know the people in communications and of course you need to know the people in legal and that's before we even get to the business people. And having a relationship with them where they can help you with issues is going to be really important. They're going to be able to help you not step in things. They're going to be able to advise you, hey, this is what our CEO likes to hear or not hear. And when I say that, I don't mean, you know, avoiding bad news. I mean, you know, is he somebody that wants to hear things through a prose memo or is she somebody that wants to receive her information through a PowerPoint or do they just want to hear it orally? Because you only get a certain amount of shots to convey critical information and you want to do it right.

Can I refer to the fact that this is a history? Yeah. Okay. So here we're talking about the history of the profession. And one of the important things about this profession are the people that developed it. I owe an incredible debt of gratitude to the people who started this profession back in, I'll call it the early 90s. They were the ones who taught me and my generation how to do this. And I think we've tried to pass that on. But I think it's harder for people to look backwards a little bit at the profession because it's become more commoditized. And I think it would behoove everybody to resist that. This is an area where some of our professional associations and others can help us. Understanding where we came from and hearing stories that people tell are really important because there is no internet article that can really convey to you all of the things you need to understand or that you're going to face in this role. It's a unique and challenging role and it's a really human role. And it's only other humans that can explain to you and help you work through it.