“You took the purest thing in your life and corrupted it, for what?” – Pete Bell, Head Coach in “Blue Chips,” a movie about boosters who secretly pay off college basketball players, played by Nick Nolte
Dr. Condoleezza Rice,
The Department of Justice’s (DOJ) announcement on September 26, 2017, of its indictment of 10 men on charges of fraud and corruption schemes within college basketball, including four Division I coaches, rattled the sports world and caused significant reputational damage – both to NCAA basketball, and likely amateur sports more broadly. From the language in the press release, subsequent news articles, and eventual suspension of five players just before the season started, it appears the FBI investigation is ongoing and several other individuals and programs may also be implicated. Indeed, while only a few know what remains to be uncovered and exposed, there is no doubt that the breadth of this scandal and the culture of noncompliance are far-reaching, and likely pervasive in several other college sports.
As an avid fan of college basketball, and an expert on fraud (and regulatory enforcement) prevention, detection, response, and remediation, I am writing to implore you to use your unique position as Chair of the newly formed Commission on College Basketball to effectuate significant and much-needed change to the culture of college basketball, and amateur sports as a whole. The changes that are needed are extensive and dramatic, and we have a proposal that we believe will help clean up the sport and hold those who violate the rules more accountable. While this letter is intended to specifically address college basketball, our proposal can and should be applied to other college sports with a similar footprint.
The NCAA is responsible for developing rules to which college sports programs must adhere. When potential and credible violations are identified, which can occur through a variety of methods, they are investigated and handled depending on the findings and severity of the breach. Once the investigation is completed, the matter is either closed (if there is no violation), referred for staff resolution (for minor violations), or referred to the Committee on Infractions (for major violations). What seems to be missing, however, is the NCAA's developing, and then encouraging colleges to implement, a standardized comprehensive model or “best practices” guidance that schools’ athletic programs should use for preventing, detecting, and responding to potential rule violations.
Accordingly, what college basketball needs to clean up the sport and level the playing field is to have the NCAA set standards and expectations for a comprehensive compliance and ethics program, and then highly encourage colleges to implement a program that models those standards. The good news is that a model already exists and has been in practice for decades. This framework, when designed and implemented properly, not only helps prevent, detect, and respond to regulatory violations, but also serves as an affirmative defense against violations that may nevertheless occur due to rogue actors and actions.
Specifically, the NCAA’s model program should be similar to what is outlined in the Federal Sentencing Guidelines as elements of an effective compliance program. This model would be akin to what corporations have in place to help them comply with general laws and regulations such as the Foreign Corrupt Practices Act as well as various industry-focused rules such as in the financial services sector (e.g., Bank Secrecy Act, USA PATRIOT Act, consumer lending, etc.) and the healthcare sector (e.g., Medicare, Medicaid, HIPAA, Patient Protection and Affordable Care Act, etc.), just to name a few. Doing so will help address all three of the Commission’s focus areas, especially “Creating the right relationship between the universities and colleges of the NCAA and its national office to promote transparency and accountability.”
At a high level, the Federal Sentencing Guidelines, Chapter 8 – Sentencing of Organizations, have seven recognized elements of an effective compliance program:
More specifically, below is more detail on each of the seven compliance elements as well as examples of how these elements could be applied to NCAA basketball in terms of preventing, detecting, and responding to issues related to the most recent allegations.
The organization shall establish standards and procedures to prevent and detect criminal conduct.
Various federal and state laws and NCAA regulations apply to college athletic programs, coaches, and student athletes. As a threshold matter, every institution should first inventory the laws and regulations that are or may be applicable, gain an understanding of those rules and regulations, and then assess the relative criticality of each (based on the severity and likelihood of a potential violation). Each institution should then establish policies, procedures, and controls that are risk-based – i.e., commensurate to the relative criticality of each law or regulation. The policies and procedures should affirmatively state that violations will not be tolerated and provide guidance on the consequences of noncompliance.
For example, given the fraud, corruption, and bribery schemes that are alleged in these most recent allegations, schools should first clearly document policies that strictly and explicitly prohibit unlawful activities. Furthermore, they should implement procedures and controls to help prevent, detect, and respond to potentially nefarious activity. Some examples of controls that should be in place include:
(A) The organization’s governing authority shall be knowledgeable about the content, and operation of the compliance and ethics program and shall exercise reasonable oversight with respect to the implementation and effectiveness of the compliance and ethics program.
(B) High-level personnel of the organization shall ensure that the organization has an effective compliance and ethics program, as described in this guideline. Specific individual(s) within high-level personnel shall be assigned overall responsibility for the compliance and ethics program.
(C) Specific individual(s) within the organization shall be delegated day-to-day operational responsibility for the compliance and ethics program. Individual(s) with operational responsibility shall report periodically to high-level personnel and, as appropriate, to the governing authority, or an appropriate subgroup of the governing authority, on the effectiveness of the compliance and ethics program. To carry out such operational responsibility, such individual(s) shall be given adequate resources, appropriate authority, and direct access to the governing authority or an appropriate subgroup of the governing authority.
Each college should be required to have a Chief Compliance Officer (CCO) who is responsible for overseeing the compliance program. The CCO should have extensive experience with, and a thorough understanding of, regulatory compliance. The CCO should also be knowledgeable of the various rules, regulations, and laws related to the program.
Additionally, the CCO should have the support of leadership, both financially and functionally, that is required to perform the job adequately (e.g., hire sufficient staff). Furthermore, the CCO should make reports directly and regularly to senior leaders at the college, providing enough information on the program so leadership can understand the program design and effectiveness. Last, senior leadership should support an independent reporting structure for the CCO to the board of directors, so the CCO can provide independent, transparent, and candid information about the program, including deficiencies identified and areas for improvement; report significant findings; and refer these significant findings for investigation.
The organization shall use reasonable efforts not to include within the substantial authority personnel of the organization any individual whom the organization knew, or should have known through the exercise of due diligence, has engaged in illegal activities or other conduct inconsistent with an effective compliance and ethics program.
Colleges should be required to perform robust due diligence on any individual (at or above a certain level) that is being considered for a position within their program. If a decision is made to ultimately hire, or not terminate upon discovery, an individual who has a history of noncompliance and/or illegal acts, the college should not be able to plead ignorance if issues later emerge in the program that relate to the individual.
While actual examples abound, consider the hypothetical case of a college basketball coach who, while not directly implicated, coached a program (or multiple programs) for years where it was later determined that significant breaches and noncompliance occurred. In an extreme example, sanctions resulted in the forfeiture of tournament appearances and even Final Four appearances. Or consider another example where it was alleged that a program regularly hired prostitutes to lure potential recruits, in violation of NCAA rules.
In both instances, the colleges that either continued to employ the coaches or ultimately hired coaching candidates were aware of the red flags that existed. Therefore, the colleges “knew or should have known” of potential “conduct inconsistent with an effective compliance and ethics program.” Accordingly, it could be strongly argued that the colleges did not “use reasonable efforts not to include within the substantial authority personnel of the organization any individual whom the organization knew” either engaged in misconduct, facilitated the misconduct, was aware of the misconduct, or at least did not take substantial measures to prevent and detect the misconduct. Hence, it appears that the colleges in both examples do not or did not meet this element of an effective compliance and ethics program.
(A) The organization shall take reasonable steps to communicate periodically and in a practical manner its standards and procedures, and other aspects of the compliance and ethics program, to the individuals referred to in subparagraph (B) by conducting effective training programs and otherwise disseminating information appropriate to such individuals’ respective roles and responsibilities.
(B) The individuals referred to in subparagraph (A) are the members of the governing authority, high-level personnel, substantial authority personnel, the organization’s employees, and, as appropriate, the organization’s agents.
Colleges should incorporate into their compliance program a comprehensive communication and training plan. First, similar to what the DOJ expects from corporations’ upper management, the plan should include regular program endorsement by university leaders such as the president, athletic director, and the coaching staff. The endorsement should stress the importance of the compliance program and set the tone for a culture of compliance; program endorsement from the highest levels is essential to program success.
Second, the communication plan should include regular reminders regarding the program such as posters in highly visible areas, screensavers, and emails.
Third, the college should identify those individuals, both internally and externally, who effect the compliance program. Those colleges should then create and regularly conduct tailored training programs for those individuals based on their roles and responsibilities – i.e., make sure they are well trained on, and knowledgeable with, the rules and regulations that are most relevant to their positions. The training programs should be interactive and dynamic, include practical examples, and be periodically updated based on recent events, identified issues, inquiries by program personnel, and other sources of information.
The organization shall take reasonable steps:
(A) to ensure that the organization’s compliance and ethics program is followed, including monitoring and auditing to detect criminal conduct;
(B) to evaluate periodically the effectiveness of the organization’s compliance and ethics program; and
(C) to have and publicize a system, which may include mechanisms that allow for anonymity or confidentiality, whereby the organization’s employees and agents may report or seek guidance regarding potential or actual criminal conduct without fear of retaliation.
For colleges to have an effective compliance program, there must be periodic monitoring, auditing, and testing of the program. That includes testing controls that are preventive, detective, and responsive. The monitoring, auditing, and testing of the program should be performed by an independent party, which could be an internal audit function or the compliance group so long as the individuals designing and performing the testing are independent in fact and appearance. The testing results and any findings should be reported directly to the program oversight function, in the corporate setting that is typically the board of directors. The testing performed should be comprehensive and risk-based, which means that the key controls over critical areas should be tested to a higher degree of confidence than those controls that are deemed less critical. Where deficiencies are identified, or if certain controls are deemed ineffective, the compliance group should remediate the issues by designing new and more effective controls that appropriately mitigate the associated risks.
An effective compliance program also includes a mechanism, such as a whistleblower hotline, to report potentially nefarious conduct. This hotline should allow for anonymous reporting as well as handle general information about the program, including inquiries. Various studies have shown that whistleblower hotlines are not only effective for detecting potentially wrongful conduct, but also serve a preventive function – i.e., individuals are less likely to commit a violation knowing that a peer could report the activity. To ensure an effective whistleblower hotline, however, the following features should be incorporated:
The organization’s compliance and ethics program shall be promoted and enforced consistently throughout the organization through (A) appropriate incentives to perform in accordance with the compliance and ethics program; and (B) appropriate disciplinary measures for engaging in criminal conduct and for failing to take reasonable steps to prevent or detect criminal conduct.
As stated in the Federal Sentencing Guidelines, and reinforced by several research and case studies, for a compliance program to be effective there must be appropriate enforcement. More specifically, the compliance program required for college basketball programs should include, but not be limited to:
As the hypothetical fact pattern from Element #3 highlights, both colleges ultimately decided to hire (or not fire) the individuals who engaged in the alleged misconduct. And it does not appear that either head coach was penalized or otherwise sanctioned for noncompliance. By not taking action, these colleges tacitly indicated to the rest of the basketball program staff that college leadership would not address instances of noncompliance. Or, perhaps more importantly, they indicated that having a successful coach and program takes priority over compliance and ethics.
Accordingly, it is likely that the tone at the top from these examples created a culture of indifference with noncompliance that ultimately may lead to more severe issues in the future. In other words, to have an effective compliance program, all rules need to be enforced and infractions penalized in order for individuals to treat compliance seriously.
After criminal conduct has been detected, the organization shall take reasonable steps to respond appropriately to the criminal conduct and to prevent further similar criminal conduct, including making any necessary modifications to the organization’s compliance and ethics program.
Even with the most robust and effective compliance programs, there is the possibility of an occasional bad act or actor. And when a bad act or actor is identified, an effective compliance program ensures that the infraction is dealt with quickly and appropriately. That may include conducting an investigation, referring the matter to law enforcement, or self-reporting the matter to the NCAA or another regulatory agency. Perhaps most important, though, is that when an issue is identified, those responsible for compliance should analyze the “how's” and “why's” to determine whether the program requires remediation and strengthening. Even the strongest system of controls needs periodic refinement, tuning, and improvement – especially as technology improves, regulations are changed, and schemes become more sophisticated and complex.
This last element of an effective compliance program, as it relates to the NCAA basketball scandal, is where you, as Chair of the Commission on College Basketball, come into play. We have substantial evidence that the existing model simply does not work – remediation is absolutely required. That is why I am recommending that the Committee implement these changes, which respond to the alleged criminal conduct and, most important, will help prevent further misconduct.
These compliance program elements comprehensively, if designed and operating effectively, are considered to be the best mechanism for preventing, detecting, and responding to potential nefarious and/or noncompliant activity. And, perhaps not surprisingly, there have been several instances of regulators such as the DOJ deciding not to prosecute organizations that have an effective program. In other words, the compliance program not only helps with dissuading and identifying unwanted activity, but also if some noncompliant and/or illegal activity does occur despite these controls, it serves as an affirmative “defense” to allegations of wrongdoing.
In the case of colleges, if violations within a program are identified, then the NCAA should first investigate whether the college’s compliance program is effective. If the program is ultimately deemed effective, that should be a mitigating factor when the NCAA is considering sanctions and penalties for violations. Conversely, if the program is deemed ineffective, that should be an aggravating factor the NCAA should consider when determining sanctions and penalties.
We firmly believe that if you, as Chair of the Commission on Basketball, recommend requiring colleges to implement these changes, then college basketball’s credibility and reputation will be restored. After all, while the damage that occurred from these indictments was significant, it is not irreparable. But real, dramatic, and effective changes are necessary to improve the culture in the sport. Implementing these recommendations is the first step.
Jesse R. Morton
Director & Southeast Forensic Services Leader
A special thank you to Justin Snell, who originally brought my attention to the importance of NCAA compliance and relevance of the Federal Sentencing Guidelines framework during the Penn State/Jerry Sandusky scandal.