Best compliance and ethics program (small to mid-cap) United States Steel Corporation
Victoria McKenney, United States Steel Corporation
United States Steel Corporation has built itself around a code of conduct since the early 20th century. Originally named after Elbert Henry Gary, one of the firm's founders, the code has evolved over time and in more recent years has become known as the STEEL Principles.
Megan Roby, senior counsel for regulatory and compliance at US Steel, describes these as the foundation of the company’s compliance and ethics program, and last year the compliance team updated the principles to ensure that this foundation remained strong. Roby describes the updated principles as being shorter and catchier to better enable employees to understand and remember them. An ‘excellence and accountability’ principle was added, and the revised code was rolled out across all of US Steel’s subsidiaries.
The team also faced the challenge of incorporating a new company – Big River Steel (BRS), which US Steel bought in January 2021 – into its compliance and ethics program. Roby explains that it wouldn’t have made sense to push US Steel’s program wholesale onto BRS, a much smaller company, so the team had to determine what worked in terms of BRS’ size and risks, among other things. Despite being tailored accordingly, BRS is subject to US Steel’s core principles.
Among other things, BRS’ compliance hotline has been unified with US Steel’s so that reports and investigations are stored and tracked in a centralized database and managed under the same standards. The integration of the compliance program took most of 2021.
This risk assessment framework is truly a one-of-a-kind, innovative tool that will be used by US Steel for years to come
Sanctions risk assessment Another item on the team’s to-do list for 2021 was conducting a sanctions-related risk assessment following new guidance from the US Treasury Department’s Office of Foreign Assets Control (OFAC).
Victoria McKenney, deputy general counsel for regulatory and compliance and deputy chief compliance officer, describes it as an ‘enormous undertaking’. The process entailed combing through mountains of data, including years of supplier and customer information, with the team assessing the company’s controls, training, processes and documentation.
With little available guidance on how to conduct a data-driven sanctions risk assessment, the team created a framework for assessing sanctions-related risks of doing business in any particular jurisdiction by incorporating company data, publicly available import and export data, the known residences of sanctioned parties, previous OFAC enforcement actions and the effectiveness of sanctions-related controls in mitigating risks.
The team was then able to use this framework to calculate the risks inherent in US Steel’s operations and assess how well its controls target those risks, for both the company and its wholly owned subsidiaries. US Steel could then identify any necessary improvements for each entity, including additional sanctions training, updating and simplifying sanctions compliance documentation and implementing targeted supply-chain controls.
‘This risk assessment framework is truly a one-of-a-kind, innovative tool that will be used by US Steel for years to come,’ the company states.
The team also showed off its artistic credentials in producing videos on compliance matters that star the animated character Code of Ethical Business Conduct – Codie, for short.
The team created Codie using off-the-shelf software and has used the videos to explain topics such as the updated STEEL Principles and the company’s new electronic process to submit compliance disclosure forms. Codie has reportedly met with rave reviews, helping to increase interest in ethics and compliance topics and improving employee engagement.
The team also received strong reviews from our judges, with one praising its ‘holistic’ approach and another noting the time and focus put into the compliance and ethics program over the past couple of years.
