Sometimes, no matter what you do or how persuasively you try, the answer is simply no. Perhaps you know that the company’s current due diligence process is deeply underfunded and therefore not picking up risks that should be caught. Perhaps you’ve tried to convince the Board that they should invest in measures so that the company can be compliant with the new European General Data Protection Regulation. Perhaps you’ve written three reports detailing the need for sanctions screening software, but are still left with an Excel sheet and no capacity to reliably screen for customers that might be sanctioned bodies. When this happens, try these three reactions:
1. Try to find an expert to agree with you
Sometimes people hire consultants to tell them what they already know. Having an outside expert confirming your opinion or giving the same recommendations that you have may make management or the Board more likely to act. Is that ridiculous? Shouldn’t they trust you without needing someone else to say the same thing? Sure. But sometimes people need to hear information from more than one source. If you can get expert support, be grateful, and try not to say, “I told you so!”
2. Put it in writing
If your company makes a terrible decision not to mitigate risk or respond to a law, put your opinion in writing. Be sure to note that you’ve brought the problem to the attention of the decision-maker, and that the decision-maker declined to take the pathway you recommended. The tone of the report or email shouldn’t be attacking. It should simply memorialize that you brought the problem to the company’s attention, and that the company decided not to respond in the way you recommended. This will be critically important if you find yourself blamed for not responding down the line.
3. Accept it
When I was having a really hard time accepting that a company I was working for wouldn’t take my advice, a friend of mine told me I should act like a doctor. She said, “Doctors tell patients to stop smoking and lose weight all the time, but only the patient can decide whether to take the advice.” Ultimately your job is to tell the company what to do to protect itself. At some point, the best path is to simply accept that it can do as it chooses.