An open letter to Condoleezza Rice, Chair – Commission on College Basketball, recommending the Federal Sentencing Guidelines compliance framework for the NCAA.

December 13, 2017

“You took the purest thing in your life and corrupted it, for what?” – Pete Bell, Head Coach in “Blue Chips,” a movie about boosters who secretly pay off college basketball players, played by Nick Nolte

Dr. Condoleezza Rice,

The Department of Justice’s (DOJ) announcement on September 26, 2017, of its indictment of 10 men on charges of fraud and corruption schemes within college basketball, including four Division I coaches, rattled the sports world and caused significant reputational damage – both to NCAA basketball, and likely amateur sports more broadly.[1]  From the language in the press release, subsequent news articles, and eventual suspension of five players just before the season started, it appears the FBI investigation is ongoing and several other individuals and programs may also be implicated.[2] Indeed, while only a few know what remains to be uncovered and exposed, there is no doubt that the breadth of this scandal and the culture of noncompliance are far-reaching, and likely pervasive in several other college sports.

As an avid fan of college basketball, and an expert on fraud (and regulatory enforcement) prevention, detection, response, and remediation, I am writing to implore you to use your unique position as Chair of the newly formed Commission on College Basketball to effectuate significant and much-needed change to the culture of college basketball,[3]  and amateur sports as a whole.[4]  The changes that are needed are extensive and dramatic, and we have a proposal that we believe will help clean up the sport and hold those who violate the rules more accountable. While this letter is intended to specifically address college basketball, our proposal can and should be applied to other college sports with a similar footprint.

The NCAA is responsible for developing rules to which college sports programs must adhere. When potential and credible violations are identified, which can occur through a variety of methods, they are investigated and handled depending on the findings and severity of the breach. Once the investigation is completed, the matter is either closed (if there is no violation), referred for staff resolution (for minor violations), or referred to the Committee on Infractions (for major violations).[5]  What seems to be missing, however, is the NCAA's developing, and then encouraging colleges to implement, a standardized comprehensive model or “best practices” guidance that schools’ athletic programs should use for preventing, detecting, and responding to potential rule violations.

Accordingly, what college basketball needs to clean up the sport and level the playing field is to have the NCAA set standards and expectations for a comprehensive compliance and ethics program, and then highly encourage colleges to implement a program that models those standards. The good news is that a model already exists and has been in practice for decades. This framework, when designed and implemented properly, not only helps prevent, detect, and respond to regulatory violations, but also serves as an affirmative defense against violations that may nevertheless occur due to rogue actors and actions.

The commission on college basketball

Specifically, the NCAA’s model program should be similar to what is outlined in the Federal Sentencing Guidelines as elements of an effective compliance program. This model would be akin to what corporations have in place to help them comply with general laws and regulations such as the Foreign Corrupt Practices Act as well as various industry-focused rules such as in the financial services sector (e.g., Bank Secrecy Act, USA PATRIOT Act, consumer lending, etc.) and the healthcare sector (e.g., Medicare, Medicaid, HIPAA, Patient Protection and Affordable Care Act, etc.), just to name a few. Doing so will help address all three of the Commission’s focus areas, especially “Creating the right relationship between the universities and colleges of the NCAA and its national office to promote transparency and accountability.”[6]

At a high level, the Federal Sentencing Guidelines, Chapter 8 – Sentencing of Organizations, have seven recognized elements of an effective compliance program:[7]

  1. Policies, procedures, and controls
  2. Effective compliance and ethics oversight
  3. Due diligence over organizational leaders
  4. Communication, training, and education
  5. Monitoring and auditing of the program
  6. Enforcement and discipline
  7. Appropriate response and remediation

More specifically, below is more detail on each of the seven compliance elements as well as examples of how these elements could be applied to NCAA basketball in terms of preventing, detecting, and responding to issues related to the most recent allegations.

Element #1: Policies, Procedures, and Controls

The organization shall establish standards and procedures to prevent and detect criminal conduct.[8]

Various federal and state laws and NCAA regulations apply to college athletic programs, coaches, and student athletes. As a threshold matter, every institution should first inventory the laws and regulations that are or may be applicable, gain an understanding of those rules and regulations, and then assess the relative criticality of each (based on the severity and likelihood of a potential violation). Each institution should then establish policies, procedures, and controls that are risk-based – i.e., commensurate to the relative criticality of each law or regulation. The policies and procedures should affirmatively state that violations will not be tolerated and provide guidance on the consequences of noncompliance.

For example, given the fraud, corruption, and bribery schemes that are alleged in these most recent allegations, schools should first clearly document policies that strictly and explicitly prohibit unlawful activities. Furthermore, they should implement procedures and controls to help prevent, detect, and respond to potentially nefarious activity. Some examples of controls that should be in place include:

  • Regular financial disclosures by coaches and student athletes (the Commission may want to also consider including the immediate family members of student athletes)
  • Random or risk-based financial audits of coaches and student athletes
  • Email and phone record reviews
  • Lifestyle analysis (i.e., a comparison of individuals’ expenses to their income to determine reasonableness)
  • Whistleblower hotlines
  • Regular background checks of coaches and other individuals involved in the program, including third-party due diligence
  • Review of the compliance programs of sports companies that do business with college programs, to make sure their compliance programs are effective

Element #2: Effective Compliance and Ethics Oversight

(A) The organization’s governing authority shall be knowledgeable about the content, and operation of the compliance and ethics program and shall exercise reasonable oversight with respect to the implementation and effectiveness of the compliance and ethics program.

(B) High-level personnel of the organization shall ensure that the organization has an effective compliance and ethics program, as described in this guideline. Specific individual(s) within high-level personnel shall be assigned overall responsibility for the compliance and ethics program.

(C) Specific individual(s) within the organization shall be delegated day-to-day operational responsibility for the compliance and ethics program. Individual(s) with operational responsibility shall report periodically to high-level personnel and, as appropriate, to the governing authority, or an appropriate subgroup of the governing authority, on the effectiveness of the compliance and ethics program. To carry out such operational responsibility, such individual(s) shall be given adequate resources, appropriate authority, and direct access to the governing authority or an appropriate subgroup of the governing authority.[9]

Each college should be required to have a Chief Compliance Officer (CCO) who is responsible for overseeing the compliance program. The CCO should have extensive experience with, and a thorough understanding of, regulatory compliance. The CCO should also be knowledgeable of the various rules, regulations, and laws related to the program.

Additionally, the CCO should have the support of leadership, both financially and functionally, that is required to perform the job adequately (e.g., hire sufficient staff). Furthermore, the CCO should make reports directly and regularly to senior leaders at the college, providing enough information on the program so leadership can understand the program design and effectiveness. Last, senior leadership should support an independent reporting structure for the CCO to the board of directors, so the CCO can provide independent, transparent, and candid information about the program, including deficiencies identified and areas for improvement; report significant findings; and refer these significant findings for investigation.

Element #3: Due Diligence Over Organizational Leaders

The organization shall use reasonable efforts not to include within the substantial authority personnel of the organization any individual whom the organization knew, or should have known through the exercise of due diligence, has engaged in illegal activities or other conduct inconsistent with an effective compliance and ethics program.[10]

Colleges should be required to perform robust due diligence on any individual (at or above a certain level) that is being considered for a position within their program. If a decision is made to ultimately hire, or not terminate upon discovery, an individual who has a history of noncompliance and/or illegal acts, the college should not be able to plead ignorance if issues later emerge in the program that relate to the individual.

While actual examples abound, consider the hypothetical case of a college basketball coach who, while not directly implicated, coached a program (or multiple programs) for years where it was later determined that significant breaches and noncompliance occurred. In an extreme example, sanctions resulted in the forfeiture of tournament appearances and even Final Four appearances. Or consider another example where it was alleged that a program regularly hired prostitutes to lure potential recruits, in violation of NCAA rules.

In both instances, the colleges that either continued to employ the coaches or ultimately hired coaching candidates were aware of the red flags that existed. Therefore, the colleges “knew or should have known” of potential “conduct inconsistent with an effective compliance and ethics program.” Accordingly, it could be strongly argued that the colleges did not “use reasonable efforts not to include within the substantial authority personnel of the organization any individual whom the organization knew” either engaged in misconduct, facilitated the misconduct, was aware of the misconduct, or at least did not take substantial measures to prevent and detect the misconduct. Hence, it appears that the colleges in both examples do not or did not meet this element of an effective compliance and ethics program.

Element #4: Communication, Training, and Education

(A) The organization shall take reasonable steps to communicate periodically and in a practical manner its standards and procedures, and other aspects of the compliance and ethics program, to the individuals referred to in subparagraph (B) by conducting effective training programs and otherwise disseminating information appropriate to such individuals’ respective roles and responsibilities.

(B) The individuals referred to in subparagraph (A) are the members of the governing authority, high-level personnel, substantial authority personnel, the organization’s employees, and, as appropriate, the organization’s agents.[11]

Colleges should incorporate into their compliance program a comprehensive communication and training plan. First, similar to what the DOJ expects from corporations’ upper management, the plan should include regular program endorsement by university leaders such as the president, athletic director, and the coaching staff. The endorsement should stress the importance of the compliance program and set the tone for a culture of compliance; program endorsement from the highest levels is essential to program success.

Second, the communication plan should include regular reminders regarding the program such as posters in highly visible areas, screensavers, and emails.

Third, the college should identify those individuals, both internally and externally, who effect the compliance program. Those colleges should then create and regularly conduct tailored training programs for those individuals based on their roles and responsibilities – i.e., make sure they are well trained on, and knowledgeable with, the rules and regulations that are most relevant to their positions. The training programs should be interactive and dynamic, include practical examples, and be periodically updated based on recent events, identified issues, inquiries by program personnel, and other sources of information.

Element #5: Monitoring and Auditing of the Program

The organization shall take reasonable steps:

(A) to ensure that the organization’s compliance and ethics program is followed, including monitoring and auditing to detect criminal conduct;

(B) to evaluate periodically the effectiveness of the organization’s compliance and ethics program; and

(C) to have and publicize a system, which may include mechanisms that allow for anonymity or confidentiality, whereby the organization’s employees and agents may report or seek guidance regarding potential or actual criminal conduct without fear of retaliation.[12]

For colleges to have an effective compliance program, there must be periodic monitoring, auditing, and testing of the program. That includes testing controls that are preventive, detective, and responsive. The monitoring, auditing, and testing of the program should be performed by an independent party, which could be an internal audit function or the compliance group so long as the individuals designing and performing the testing are independent in fact and appearance. The testing results and any findings should be reported directly to the program oversight function, in the corporate setting that is typically the board of directors. The testing performed should be comprehensive and risk-based, which means that the key controls over critical areas should be tested to a higher degree of confidence than those controls that are deemed less critical. Where deficiencies are identified, or if certain controls are deemed ineffective, the compliance group should remediate the issues by designing new and more effective controls that appropriately mitigate the associated risks.

An effective compliance program also includes a mechanism, such as a whistleblower hotline, to report potentially nefarious conduct. This hotline should allow for anonymous reporting as well as handle general information about the program, including inquiries. Various studies have shown that whistleblower hotlines are not only effective for detecting potentially wrongful conduct, but also serve a preventive function – i.e., individuals are less likely to commit a violation knowing that a peer could report the activity. To ensure an effective whistleblower hotline, however, the following features should be incorporated:

  • Policies and procedures should ensure that whistleblowers are protected against retaliation
  • Senior leadership should emphasize that retaliatory conduct will not be tolerated
  • Senior leadership should regularly encourage whistleblowers to use the hotline
  • The tone at the top must stress the importance of doing the right thing
  • The hotline should be prominently advertised in public and high-traffic areas such as copy rooms, lunch rooms, etc.
  • The hotline should have adequate policies and procedures for receiving, processing, and handling reports, including a timeline for follow-up and resolution
  • The hotline should have multiple mechanisms for reporting conduct – e.g., telephone, email, web-based form, fax
  • The hotline should be available 24/7
  • The hotline should have a simple and anonymous process for following up with the complainant
  • The hotline reports should be triaged according to the type, severity, and nature of the issue
  • There should be an established process for investigating matters, referring matters to internal or external counsel, referring matters to law enforcement, etc.
  • Provide incentives to whistleblowers for reporting credible, reliable, and new information[13]

Element #6: Enforcement and Discipline

The organization’s compliance and ethics program shall be promoted and enforced consistently throughout the organization through (A) appropriate incentives to perform in accordance with the compliance and ethics program; and (B) appropriate disciplinary measures for engaging in criminal conduct and for failing to take reasonable steps to prevent or detect criminal conduct.[14]

As stated in the Federal Sentencing Guidelines, and reinforced by several research and case studies, for a compliance program to be effective there must be appropriate enforcement. More specifically, the compliance program required for college basketball programs should include, but not be limited to:

  • Program endorsement by senior leadership
  • Adherence to a culture of compliance
  • Rewards, both financial and nonfinancial (e.g., recognition), for maintaining compliance and adhering to the policies and procedures
  • Policies and procedures that specifically outline the penalties for noncompliance
  • Penalties that are commensurate with the infraction and that are consistently applied without regard to position or seniority
  • Hold accountable those individuals who disregard the policies and procedures, even if there is not a technical violation

As the hypothetical fact pattern from Element #3 highlights, both colleges ultimately decided to hire (or not fire) the individuals who engaged in the alleged misconduct. And it does not appear that either head coach was penalized or otherwise sanctioned for noncompliance. By not taking action, these colleges tacitly indicated to the rest of the basketball program staff that college leadership would not address instances of noncompliance. Or, perhaps more importantly, they indicated that having a successful coach and program takes priority over compliance and ethics.

Accordingly, it is likely that the tone at the top from these examples created a culture of indifference with noncompliance that ultimately may lead to more severe issues in the future. In other words, to have an effective compliance program, all rules need to be enforced and infractions penalized in order for individuals to treat compliance seriously.[15]

Element #7: Appropriate Response and Remediation

After criminal conduct has been detected, the organization shall take reasonable steps to respond appropriately to the criminal conduct and to prevent further similar criminal conduct, including making any necessary modifications to the organization’s compliance and ethics program.[16]

Even with the most robust and effective compliance programs, there is the possibility of an occasional bad act or actor. And when a bad act or actor is identified, an effective compliance program ensures that the infraction is dealt with quickly and appropriately. That may include conducting an investigation, referring the matter to law enforcement, or self-reporting the matter to the NCAA or another regulatory agency. Perhaps most important, though, is that when an issue is identified, those responsible for compliance should analyze the “how's” and “why's” to determine whether the program requires remediation and strengthening. Even the strongest system of controls needs periodic refinement, tuning, and improvement – especially as technology improves, regulations are changed, and schemes become more sophisticated and complex.

This last element of an effective compliance program, as it relates to the NCAA basketball scandal, is where you, as Chair of the Commission on College Basketball, come into play. We have substantial evidence that the existing model simply does not work – remediation is absolutely required. That is why I am recommending that the Committee implement these changes, which respond to the alleged criminal conduct and, most important, will help prevent further misconduct.

These compliance program elements comprehensively, if designed and operating effectively, are considered to be the best mechanism for preventing, detecting, and responding to potential nefarious and/or noncompliant activity. And, perhaps not surprisingly, there have been several instances of regulators such as the DOJ deciding not to prosecute organizations that have an effective program. In other words, the compliance program not only helps with dissuading and identifying unwanted activity, but also if some noncompliant and/or illegal activity does occur despite these controls, it serves as an affirmative “defense” to allegations of wrongdoing.

In the case of colleges, if violations within a program are identified, then the NCAA should first investigate whether the college’s compliance program is effective. If the program is ultimately deemed effective, that should be a mitigating factor when the NCAA is considering sanctions and penalties for violations. Conversely, if the program is deemed ineffective, that should be an aggravating factor the NCAA should consider when determining sanctions and penalties.

We firmly believe that if you, as Chair of the Commission on Basketball, recommend requiring colleges to implement these changes, then college basketball’s credibility and reputation will be restored. After all, while the damage that occurred from these indictments was significant, it is not irreparable. But real, dramatic, and effective changes are necessary to improve the culture in the sport. Implementing these recommendations is the first step.

Thank you.

Jesse R. Morton
Director & Southeast Forensic Services Leader
Stout

A special thank you to Justin Snell, who originally brought my attention to the importance of NCAA compliance and relevance of the Federal Sentencing Guidelines framework during the Penn State/Jerry Sandusky scandal.


 

  1. U.S. Department of Justice, Press Release, “U.S. Attorney Announces the Arrest of 10 Individuals, Including Four Division I Coaches, for College Basketball Fraud and Corruption Schemes,” September 26, 2017.
  2. CBS Sports Staff, “College Basketball Scandal Updates: USC’s De’Anthony Melton Suspended,” CBS Sports, November 11, 2017.
  3. See detailed description of the Commission on College Basketball, including its members.
  4. “Statement from Mark Emmert on the Formation of a Commission on College Basketball,” NCAA, October 11, 2017.
  5. See NCAA Enforcement, Summary of Case Paths. Eligibility matters are handled through a separate process.
  6. See NCAA Commission on College Basketball.
  7. 2015 Federal Sentencing Guidelines, §8.B.2.1, Effective Compliance and Ethics Program, available here. (hereinafter “Federal Sentencing Guidelines.”)
  8. Federal Sentencing Guidelines, §8.B.2.1(b)(1).
  9. Id. §8.B.2.1(b)(2).
  10. Id. §8.B.2.1(b)(3).
  11. Id. §8.B.2.1(b)(4).
  12. Id. §8.B.2.1(b)(5).
  13. See, e.g., Dodd-Frank §922.
  14. Federal Sentencing Guidelines, §8.B.2.1(b)(6).
  15. See, e.g., E.B., “What ‘Broken Windows’ Policing Is,” The Economist, January 27, 2015.
  16. Federal Sentencing Guidelines, §8.B.2.1(b)(7).

Related Professionals

All Related Professionals