small budget, small progress?...2 about plan international usa plan international usa, part of plan...

1

Small budget,

small progress?

Kitty Holt

October 2017

In this session, I intend to cover…

�The steps one non-profit took in carrying out a compliance program on a tight budget.

�The importance of prioritizing new activities while building on previous work.

�The importance of internal and external benchmarking; relationship building; and other keys in making progress.

2

About Plan International USA

Plan International USA, part of Plan International, is a development and humanitarian organization founded in 1937 that advances children’s rights and equality for girls. We work with children, young people, our supporters, and partners in more than 70 countries around the world.

Globally, Plan is a $890+ million organization and in FY16, our community-based programs directly impacted more than 69 million people.

Our expertise focuses on six areas: 1. disaster and conflict 4. education 2. health 5. protection3. water, sanitation, and hygiene 6. youth and economic empowerment

Our goal is to help people -- particularly children and girls -- move from a life of poverty to a future with opportunity.

Agenda

3

Background on Plan’s

compliance program

• 2010: Task Force convened by COO

• Task force reviewed FSG, compliance programs of peers, and compliance literature; and conducted an inventory. The inventory found:

• a lack of understanding;

• inadequate internal communication and lack of compliance ownership;

• inconsistent development, organization, and implementation of internal policies.

• Recommended compliance program headed by 1 FT person, with direct reporting to Board.

Background on Plan’s

compliance program - recommendations

1. Centralize

2. Sr. management support

3. Compliance tasks aligned

4. Policies – implement, review, revise

5. Include compliance tasks in job descriptions & performance reviews

6. Training

7. Managerial awareness and communication

8. Stay current on compliance trends/laws

4

2011 (May to December)

New initiatives (for Plan International USA)

• E&CO identified (2)

• Peer visit (2)

• Internal baseline survey; policy awareness low (5, 1)

• Compliance Committee (CC) (2)

• CC drafted “policy on policies” (1)

• Current policies reviewed (1)

• Contract review policy and training (1)

• Compliance intranet page (4)

• Quarterly update shared with Executive Team (ET) and CC (4)

• Nonprofit Compliance Networking Group (CNG) benchmarking survey (5)

Note: number in parentheses represents the FSG element

2011 (May to December)

Ongoing initiatives

�Modified:

• Changes to background check processes (3)

• PCI DSS training now an avatar video with CEO intro (4)

�Continued with little/no change:

• Review of user access (3)

• Annual COI disclosures for board and key staff (3)

• Provided input on global risk register and internal Excel-based

risk register developed by COO (5)

5

2012

New initiatives (for Plan International USA):

• Folder to house policies; policies assigned owner and review schedule; added to intranet with

summary and link to owner (1)

• “Following policies” added to performance reviews (6)

• Review FCPA requirements (1)

• Voluntary child protection audit (3)

• Join Audit Committee meetings for compliance portion; share quarterly update (3)

• Started meetings with HR due to overlap; who owns what issues (lasted about a year) (3)

• Charity watchdog requirements gathered together; staff training (4); developed model to

anticipate charity watchdog ratings(5)

• First ever four-star rating on Charity Navigator (6)

• Co-present at SCCE CEI (2)

• Compliance champion program (6)

2012

Ongoing initiatives:

�Modified:

• Developed new PCI training video, included staff (4)

• Quarterly CNG calls (5)


• Internal benchmarking survey repeated (5)

• External CNG survey repeated (5)

• Meet with CNG on social media policy; began review (1)

• Annual COI disclosures for board and key staff (3)

• Continued providing input into excel-based risk register (5)

• A number of policies updated (1)


• Quarterly update (4)

• CC focusing on issues from across the organization (grants, branding, audits, etc.) (2)

6

2013


• Present to full board (3)

• External audit interview (3)

• Took on temporary strategic planning role half-time (2)

• Heading up work group of other PVOs revising standards for child sponsorship organizations (1)

• Privacy week held. End of week survey: people will change behavior (4)

• Corp ethics and compliance week: series of questions on policies, half of staff participated (4)

• Compliance program featured in Ethikos; helped increase understanding of program (4)

• Work with marketing to ensure new vendors are aware of legal requirements (7)

• Stickers around locking computers (7)

• Working group around Schedule O in IRS 990 (7)

2013


�Modified:

• Presented CNG survey to ET and Audit Committee (3)

• CC members given t-shirts ; wore on specific day (2)

• COO leaves; E&CO reports to CEO (2)

• HQ implemented online global risk register; we are test office, begin to plug in our info (5)


• AC meetings continue (3); annual COI disclosures for board and key staff (3); E&CO presented at SCCE CEI (2)

• CC: risk register, survey results, watchdogs, business plans (1), learnings from another NGO suspended from

USAID funding (7)

• Continued updating of policies (1); PCI training (4); quarterly update (4); compliance champion program (6)

• Regular CNG calls/emails (5); review of user access (3); complete revision of “proofreading checklist” regarding

marketing materials to donors (1)

• Continued monitoring of charity watchdog changes; some require changes to policies and practices (5); re-

accreditation with BBB (5)

• Internal and external survey repeated (5)

7

2014


• HQ implemented worldwide WB line (5)

• Roll out revised WB policy and hotline (4)

• Core values identified; worked with marketing on roll out plan (4)

• Social media jeopardy (4)

2014


� Modified:

• Annual COI disclosures by all staff and board (3)

• External website redesigned; compliance requirements included (1)

• Online risk register live; training staff and updating. Reduced risks from 32 to 15 (5)

� Continued with little/no change:

• AC meetings continue (3); strategic planning work continues (2); continued updating of policies (1);

new regulations around NY Nonprofit Revitalization Act; updating of five policies and procedures

(1); policy awareness (4)

• Present to full board on compliance program (3);

• External audit interview (3); PCI training (4); quarterly update (4); review of user access (3)

• Compliance Committee (2); internal & external survey repeated (5); presented to CC, ET, Audit

Comm, & all staff (internal only) (2)

• Compliance champion program (6); regular CNG calls/emails (5); continue charity watchdog work

(5), including working group around Schedule O (7)

8

2015


• E&CO update intranet; policies updated immediately (2)

• Present at Nonprofit Risk Management Center and SCCE; article

in Ethikos (2)

• Full day session with fundraising legal counsel experts (4)

• Roll out of “Compliance Corner,” quarterly 2-page newsletter (4)

• Prep for onsite PCI review (4)

• Core values added to reviews (6)

• Review policy training vendors (1)

• Compliance question added to exit interview (5)

2015


�Modified:• Global Standards (policies which apply worldwide) review (1)

• Rolled out legal templates (nondisclosure, etc.) (1)

• Join full AC meetings (3)

• Quarterly risk register; present to full board (as well as ET and CC) (3)

• E&CO now reports to VP of HR; monthly meetings with CEO (2)

• Quarterly update now includes updates from Grants Compliance and Legal Counsel (4)

• Developed quarterly risk register process (5)

• COI forms now reviewed by E&CO (3)

�Continued with little/no change:• Global WB line (5); core values rolled out (4); present to full board on compliance program (3); re-accreditation with BBB (5);

• PCI training (4); internal survey repeated (5); review of user access (3); Compliance Committee (7);

• Staff training on watchdogs; high ratings with two watchdogs (4)

• Continued updating of policies, including review of policies needed by government (1); external audit interview (3)

• Internal survey repeated (5); presented to CC, Executive Team, Audit Comm, & all staff (2); compliance champion program (6)

• Regular CNG calls/emails (5); continue charity watchdog work (5), including working group around Schedule O (7)

9

2016


• Achieved GuideStar Platinum status (5)

• Calls with other “risk focal points” from across organization (5)

• Rolled out online training (social media, ethics, cybersecurity) (4)

• Online training – rewards for completion by division (6)

2016


�Modified:• BCP – all units writing procedures, lists of vendors, contact info, log in info (1)

• Bring state registration filings in house (1)

• Work with other non-profits on influencing watchdog changes (5)

• Compliance Committee (2) working on carrots and sticks approach to training, timesheets, etc. (6)

�Continued with little/no change:• Global WB line (5); present to full board on compliance program (3); COI disclosures (3)

• Continued updating of policies (1); update of proofreading checklist (1); join full AC meetings (3)

• Quarterly risk register (3); quarterly update (4); quarterly newsletter, Compliance Corner (4)

• Internal survey repeated; external survey done with help of intern (5); quarterly risk register continues (5)

• Review of user access (3); PCI training (4); biennial non-profit self-certification obtained (5)

• Internal & external survey repeated (5); presented to CC, Executive Team, Audit Comm, & all staff (internal only) (2)

• Compliance champion program (6); regular CNG calls/emails (5); continue charity watchdog work (5), including working group around

Schedule O (7)

10

2017 (January – July)


• Policy revision logs (1)

• Three key points for each policy; one highlighted per month(1)

• Training calendar(4)

• Dry run of BBB (charity watchdog) re-accreditation (5)

• Preparation for external assessment of program (5)

2017 (January – July)


�Modified:

• Staff preparing for maternity leave. E&CO to take over work during leave (2)

• Risk register moved to semi-annual updates for owners (5)

• Risk focal point calls now quarterly (5)


• Global WB line (5); continued updating of policies , including by-laws and standing policies (1)

• Join full AC meetings (3); online PCI and Diversity & Inclusion Training (4); in-person training on revised policies; testing

awards for completion (6)

• Continue quarterly update (4); continue quarterly newsletter, Compliance Corner (4)

• Risk Management Plan completed (5); accountability presentation developed for Executive Team (6)

• Internal & (revamped) external survey repeated (5); presented to CC, Executive Team, Audit Comm, & all staff

(internal only) (2)

• Compliance champion program (6); regular CNG calls/emails (5); Compliance Committee (7)

• Continue charity watchdog work (5), including working group around Schedule O and staff training (7, 4)


11

Results of internal survey

2011 2012 2013 2014 2015 2016 2017

Awareness of child protection policy 67% 77% 85% 79% 87% 79% 88%

Confidentiality 63 53 57 64 70 72 77

Code of ethics 55 44 57 68 72 71 77

WB 49 48 51 60 78 71 79

Report concerns 88 96 96 94 95 94 97

Clear to whom you should report concerns? 66 76 88 85 90 91 98

Agenda




12

Staff preparing for maternity leave. E&CO to take over work during leave

Risk register moved to semi-annual updates for owners

Risk focal point calls now quarterly

Global WB line

Continued updating of policies

Join full AC meetings

Testing awards for completion

Continue quarterly update

Quarterly newsletter, Compliance Corner

Risk Management Plan completed

Internal & (revamped) external survey Compliance champion program

Regular CNG calls/emails

Continue charity watchdog workWorking group around Schedule O

Staff training on watchdogs

Accountability presentation developed for Executive Team

Policy revision logs

Three key points for each policy; one highlighted per month

Training calendar

Achieved GuideStar Platinum status

Rolled out online training (social media, ethics, cybersecurity)

Peer visit E&CO identified

Internal baseline survey; policy awareness low

Current policies reviewed

Contract review policy and training

Compliance intranet page

Quarterly update shared with Executive Team and CC

Nonprofit Compliance Networking Group (CNG) benchmarking survey

Changes to background check processes

PCI DSS training now an avatar video with CEO intro

Review of user access

Annual COI disclosures for board and key staff

Provided input on global risk register and

internal Excel-based risk register developed

by COO

Folder to house policies; policies assigned owner and review schedule; added to intranet with summary and link to owner

“Following policies” added to performance reviews

Review FCPA requirements

Voluntary child

protection audit

Join Audit Committee for compliance portion; share quarterly update

Charity watchdog requirements gathered together; staff training; developed model to anticipate charity watchdog ratings

First ever four-star rating on Charity Navigator

Co-present at SCCE CEI

Compliance champion program

Prioritizing

Present to full board

External audit interview

Took on strategic

planning role half-time

Privacy week held.

Compliance program featured in Ethikos; helped increase understanding of program

HQ implemented worldwide WB line

Roll out revised WB policy and hotline

Core values identified; worked with marketing on roll out plan

Annual COI disclosures by all staff and board

Online risk register live; training staff and updating.

Full day session with fundraising legal counsel experts

Roll out of “Compliance Corner,” quarterly 2-page newsletter

Prep for onsite PCI review

Compliance question added to exit interview Achieved GuideStar Platinum Status

Prioritizing

• You cannot do everything at once.

• Choose just a few new items to work on each year.

• At the same time, continue previous work, with adjustments as needed.

13

Agenda




Other keys to making progress

Get involved :

EXAMPLES

• PVO Standards

• Strategic Planning

• Global Risk Register

• External website

Benchmarking

WHAT

• Internal survey

• External survey

• Policies

• Peer organization visit

• Intranet page

• Quarterly update

• Risk register

• Incentives and discipline

• Reporting lines

• And so much more (you do not need to design everything

from scratch)

WHERE:

• Published surveys

• Your own surveys

• SCCEnet /SCCE conferences

• Compliance groups; regional ethics groups

Build relationships (critical in E&C role):

EXAMPLES

• Introduction email to new employees

• Take new employees to lunch

• Focus orientation on knowing they can contact you

• Help others meet their goals

• Make connections

14

Questions?

Contact:

[email protected]

https://www.linkedin.com/in/kitty-holt-66520610/ (identify yourself as attendee)

small budget, small progress?...2 about plan international usa plan international usa, part of plan...

Documents