It’s no secret that companies have been adopting a more data-centric approach to managing risk and compliance and to improving internal audit. They are installing fancy software packages and hiring data analytics experts to help them sift through oceans of valuable data to look for patterns and outliers.
But some forward-thinking companies are simultaneously going in the other direction too. They are hiring behavioral scientists to provide them with more insight on risk management and decision making from a human behavior perspective.
A new report published by law firm Ropes & Gray finds that some pioneering companies are hiring behavioral scientists to assist risk management and assessment functions and many more are considering adding behavioral science expertise to their teams. Indeed, the report finds that a data-driven approach to compliance and risk management is actually increasing the need for behavioral science skills, as companies look to gain a better understanding of what the data is saying in terms of how certain factors influence employee and management behaviors.
While the law firm acknowledges that, “only a handful of companies have actually implemented a behavioral sciences approach to their compliance programs,” it could be the next big thing. According to the study, more than half (52 percent) are aware of the benefits of using behavioral science to inform risk management, audit, and compliance, and a significant majority (84 percent) say they believe it would be helpful or very helpful in helping them identify and manage their risks going forward.
An earlier research paper by advisory firm Deloitte cited Fujitsu, MI3 Security, and DebMed as companies that were using some aspects of behavioral science in their risk management efforts.
What Makes a Good Man Turn Bad?
Broadly defined, behavioral science is the study of human habits, actions, and intentions; it spans the fields of psychology, cognitive science, social work, human resources, economics, sociology, and organizational behavior. Ultimately, behavioral science is concerned with what makes humans do what they do.
“One of things we’ve heard from clients time and again is that despite investing heavily in developing robust compliance programs, bad conduct still happens,” says Amanda Raad, co-head of Ropes & Gray’s risk management practice. “Instead of relying on legal and compliance professionals developing and implementing a policy, companies are beginning to focus on the root cause of behavior to understand what motivates people to engage in bad conduct.”
A better understanding of human behavior is essential to setting the levers that really shape culture and therefore influence the behaviors and actions that make companies successful.
Given the intense focus on corporate culture in the last few years, the pursuit of a better understanding of human behavior and drivers of particular actions makes sense. Companies are quickly coming around to the idea that they have to get culture right to drive the behaviors and actions they want. And they also realize that mission statements, paper policies, and codes of conduct only go so far in influencing culture. A better understanding of human behavior is essential to setting the levers that really shape culture and therefore influence the behaviors and actions that make companies successful.
According to the report, companies are looking to behavioral scientists to help answer the question: “What motivates employees to commit fraud or bribe officials when rules and regulations so clearly prohibit this kind of behavior?”
“The traditional policy-led approach to compliance is looking increasingly dated and may ultimately be bad for business. Companies failing to innovate in this area run the risk of falling behind their competitors,” says Ryan Rohlfsen, co-head of Ropes & Gray’s risk management practice.
While behavioral science has been, admittedly, a greater focus for compliance and risk management than internal audit, it’s easy to see how it could extend to internal audit, as auditors are charged with assuring such programs are effective. And as internal audit moves more into the risk-management consulting realm, it will need to gain a better understanding of the underlying human behavioral components of ethics, fraud, compliance, and culture.
Not a New Connection
While few internal audit and compliance functions are currently hiring teams of behavioral scientists, the connection between corporate compliance and human behavior is hardly new. In a 2015 research paper, “Behavioral Ethics, Behavioral Compliance,” Georgetown University Law Professor Donald Langevoort observes that the use of behavioral factors when designing and implementing compliance programs has been a subject of debate “for decades.” And certainly the field of organizational behavior and the use of behavioral science in sales and marketing and what incentivizes people to work harder are much older than that.
Still the application of behavioral science to compliance, internal audit, and risk management is in its earliest stages. As Langevoort writes in his paper: “A rapidly growing body of cognitive research is shedding light on when, how, and why wrongdoing occurs.” Indeed, he thinks the use of behavioral science is important aspect of creating effective compliance programs. “The design of an effective legal compliance system for an organization fearing prosecution for white-collar crime or regulatory violations requires skill at predicting human behavior.”
Indeed, in 2016 Deloitte predicted the greater use of behavioral science in risk management in a paper titled, “The Future of Risk: New Game New Rules.” “There is increasing demand for these skills in the business world—including risk organizations. What drives risky behavior? How do cognitive biases lead people to wrongly assess risk? How can risky behaviors be detected and modified? These are the types of questions leading organizations are looking to answer with behavioral science,” the report’s authors write.
“A rapidly growing body of cognitive research is shedding light on when, how, and why wrongdoing occurs.”
—Donald Langevoort, Georgetown University Law Center
To be sure, many organizations may be using behavioral science in risk management without calling it that or even realizing that they are using it. Identifying those employees most vulnerable to phishing scams, for example, and training them on recognizing phony and harmful emails relies heavily on behavioral science principles, as do many other training programs on ethics and fraud prevention.
Science and Data
Adding more behavioral science capabilities can actually boost a data-driven approach, since companies need help understanding what the data is saying. Behavioral science can help companies determine if there are drivers of certain behaviors hidden in the data.
“Companies need to conduct behavioral science-focused working group sessions, or discussions with employees, to help interpret the data and apply the findings to their compliance programs,” says Raad at Ropes & Gray.
Awareness by Region and Sector
There is, however, a stark contrast in levels of awareness of the potential benefits of applying behavioral science between companies in Europe and North America, with those in Asia and Latin America. Most companies in Europe (81 percent) and North America (77 percent) are aware of the new approach, with even more seeing value in using it to inform their compliance programs (93 percent in Europe and 94 percent in North America). This contrasts with the levels of awareness in Asia and Latin America, where just 20 percent of companies in Asia and 7 percent of companies in Latin America have heard of the approach and, correspondingly, there is less recognition of its value (48 percent in Asia and 57 percent in Latin America).
The research also found differences in awareness by sector. Most technology (64 percent) and life sciences (60 percent) companies, alongside banks (56 percent) have heard of the approach and see value it in. In contrast, fewer asset managers (48 percent) and private equity firms (42 percent) are up to speed on the development.
More About the ‘Why’
Don’t expect an army of behavioral scientists to start occupying offices in the compliance, risk management, and internal audit departments anytime soon. Yet there is no doubt that these disciplines can benefit from a greater understanding of human behavior and the underlying motivations for both good and bad behavior. Even just adding some thinking along these lines, or seeking the input of a behavioral science expert could be valuable.
“Most employees are not going to work intending to break the law or do something that hurts the company,” says Ropes & Gray’s Raad. And yet, most companies experience higher levels of such behavior than they would like. Finding out more about why could go a long way to preventing it. 
Joseph McCafferty is Editor and Publisher of Internal Audit 360°.