Based on a real case · decision options are for teaching purposes
INTD401 · Business Ethics and Compliance · Lecture 2
Making ethics a system: rules, risk, controls, culture. Why are good intentions alone not enough?
10+ years of experience in marketing, sales and project management
AI marketing trainer
Master of Marketing (MBA) · teaching business ethics and fundamentals of marketing since 2022
17:40–20:05 · Bldg 5, Room 605 · 145 minutes
Navigation: use the ← → keys, or swipe the screen left/right. M contents · N instructor notes · ? help
Today's path
| Time | Chapter | Contents |
|---|---|---|
| 17:40–17:50 | Opening | Previous assignment, opening survey |
| 17:50–18:25 | I · What Is Compliance | Three levels, two approaches, the fraud triangle, Wells Fargo, the Mongolian and international framework, standards |
| 18:25–18:35 | Break | 10 minutes |
| 18:35–19:20 | II · Program | 6 elements, “paper program,” risk matrix, third parties, gifts and bribery, reporting channel, metrics |
| 19:20–19:30 | Break | 10 minutes |
| 19:30–20:05 | III · Decision | Three cases (one from Mongolia), a marketer’s checklist, conclusion, assignment |
The clock in the top bar shows which chapter is currently running.
Previous assignment
2–3 people, 1 minute: which ad, what violation, who is harmed?
An ad and its “true but misleading” part
Transparency · Newspaper · Reversibility · Long-term
Today's key question: who should have checked, and by what procedure?
Opening poll
Three everyday situations. Answer with your own judgment first.
Chapter I
From good intentions to a system that works
17:50 — 18:25 · three levels · two approaches · fraud triangle · Wells Fargo · law · standards
Key idea
Good intentions alone do not protect against violations — rules, controls, and culture are all three needed.
Definition
National laws, regulations, and regulators' requirements. Example: the Law on Protection of Personal Information.
Terms of contracts with partners, investors, and banks; industry standards; international requirements.
An organization’s code of ethics, policies and procedures — the company’s commitments to itself.
ISO 37301:2021. Compliance management systems — Requirements with guidance for use · Ferrell, Fraedrich & Ferrell (2022). Business Ethics, 13th ed., ch. 8
Compliance theory
| Compliance approach | Integrity approach | |
|---|---|---|
| Idea | Following externally set rules | Guided by self-chosen values |
| Objective | Preventing legal violations | Encouraging responsible conduct |
| Assumptions about people | A self-interested, independent individual | A social person guided by values and by the community |
| Method | Control, Discipline, Sanctions | Leadership, training, decision-making ability |
| Weakness | A mindset of “if the law doesn’t forbid it, it’s fine” | Too vague; no clear boundaries |
Treviño et al. (1999): employees seeing the program as values-based, leaders following the rules themselves, and fair treatment of employees reduce unethical behavior the most. A program aimed only at “protecting management” has the opposite effect.
Rules without values are vague; values without rules are dry. A good program sets clear boundaries and, within them, gives people the ability to make the right decision.
Paine, L. S. (1994). Managing for organizational integrity. HBR, 72(2), 106–117 · Treviño, L. K., Weaver, G. R., Gibson, D. G., & Toffler, B. L. (1999). California Management Review, 41(2), 131–151 · Weaver, Treviño & Cochran (1999). Academy of Management Journal, 42(1), 41–57
Behavioral theory
Fraud triangle — Cressey (1953)
People weigh probability of detection × penalty against the benefit. Raising the probability of detection is more effective than making penalties harsher.
Goals that are too high, too narrow and short-term push people to ignore the means and fudge the numbers.
When a problem is labeled “just a business decision,” its ethical side stops being noticed.
Cressey, D. R. (1953). Other People’s Money · Becker, G. S. (1968). Journal of Political Economy, 76(2), 169–217 · Ordóñez, L. D. et al. (2009). Academy of Management Perspectives, 23(1), 6–16 · Tenbrunsel, A. E., & Messick, D. M. (2004). Social Justice Research, 17(2), 223–236
Real case · marketing KPIs
Wells Fargo set a target of selling 8 products to each customer and launched the slogan “Eight is great.” Branch staff were given daily sales quotas, under the threat of dismissal if they were not met.
As a result, employees opened millions of accounts and cards without customers’ consent, forged signatures and altered customer information. One internal investigator had called it a “growing plague” as early as 2004.
The CEO resigned. In 2017, the bank re-estimated the number of unauthorized accounts at up to 3.5 million.
“The bank traded the reputation it had earned over many years for short-term profit” — US prosecutor Nick Hanna.
Which side of the fraud triangle is most prominent? Which control failed?
Pressure — unrealistic quotas. Opportunity — account opening did not require customer verification. Rationalization — “everyone does it,” “customers aren’t harmed.” Even though warnings were received, firing the employees who reported them instead of taking corrective action was the biggest mistake.
U.S. Department of Justice (2020, Feb 21). Wells Fargo agrees to pay $3 billion to resolve criminal and civil investigations into sales practices · CFPB (2016) · OCC (2020)
Why it matters
Siemens (2008): about $1.6 billion in total in the US and Germany in a bribery case. Wells Fargo (2020): $3 billion.
Loss of license, loss of the right to bid in tenders, suspension of bank financing.
The trust of consumers, investors, partners and future employees — the slowest to rebuild.
Administrative and criminal liability. Wells Fargo’s former CEO was fined $17.5 million and banned from the industry.
U.S. DOJ (2008). Siemens AG and three subsidiaries plead guilty to FCPA violations · OCC (2020). Former Wells Fargo executives · Criminal Code of Mongolia (2015), Chapter 9
Mongolian context
| Direction | Key risk | Law | Control |
|---|---|---|---|
| Anti-corruption | Graft, bribery, conflict of interest | Anti-Corruption Law; Criminal Code | IAAC |
| Anti-Money Laundering | Suspicious transactions, know your customer | Law on Combating Money Laundering and Terrorist Financing | Financial Information Unit of the Bank of Mongolia, Financial Regulatory Commission |
| Personal data | Unauthorized processing, leakage | Law on Protection of Personal Information (2021) | NHRC; ministry in charge of digital development |
| Consumers, Competition | Misleading ads, unfair competition | On Consumer Protection; On Competition; On Advertising | Anti-Monopoly Agency |
| Labor and safety | Accidents, discrimination, harassment | Labor Law (2021) | Labour inspectors of the ministry in charge of labour |
| Tax, finance | Misstated reports, bookkeeping errors | Tax laws, Law on Accounting | General Department of Taxation |
Check the current text on legalinfo.mn. For the exam, it is enough to know which law regulates what.
International framework
Bribing foreign officials is prohibited; it has extraterritorial reach. Although enforcement priorities changed in 2025, the law remains in force.
“Failure to prevent bribery” is a stand-alone corporate offense — the only defense is “adequate procedures.” Since 1 Sept 2025 the same applies to fraud for large organizations (“reasonable procedures”).
Applies to the data of EU residents. Fines up to 4% of global turnover; breaches must be reported within 72 hours. Meta was fined 1.2 billion € in 2023.
The international standard for combating money laundering. Mongolia was placed on the “grey list” in 2019 and removed in 2020.
U.S. Executive Order on pausing FCPA enforcement (2025, Feb 10) · U.S. DOJ (2025, June 9). FCPA Enforcement Guidelines · UK Bribery Act 2010, s.7 · Economic Crime and Corporate Transparency Act 2023 · GDPR Art. 33, 83 · Irish DPC (2023) · FATF (2019, 2020)
Standards and structure
| Standard | What it is about |
|---|---|
| ISO 37301:2021 | A compliance management system — policy, risk, controls, continuous improvement |
| ISO 37001:2025 | Anti-corruption management system — gifts, third parties, financial controls |
| ISO 37002:2021 | Whistleblowing management system |
| ISO 31000:2018 | Risk management principles and process |
Certification is not required, but its structure can be used as a model.
ISO 37301:2021 · ISO 37001:2025 · ISO 37002:2021 · ISO 31000:2018 · Institute of Internal Auditors (2020). The IIA’s Three Lines Model
Game 1 · Identify the Direction
Classify each situation. An explanation appears after each answer.
Break 1
Next: how a compliance program works — 6 elements, risk matrix, gifts and bribery.
Chapter II
From policy on paper to a working system
18:35 — 19:20 · 6 elements · risk matrix · third party · gifts and bribery · reporting channel · metrics
Compliance program
Click each card to see a marketing example.
U.S. Sentencing Commission. Guidelines Manual §8B2.1 — Effective Compliance and Ethics Program · ISO 37301:2021 · OECD (2010/2021). Good Practice Guidance on Internal Controls, Ethics and Compliance
Real or paper?
Is it based on a risk assessment? Are the rules clear and accessible to employees?
Can the responsible person reach senior management directly? Are the budget, staff, and independence sufficient?
Are violations being detected and resolved? Is the program being updated with lessons learned?
Rules copied from an outside template · nobody is accountable · training is a once-a-year signature · a reporting channel exists but nobody uses it · management is exempt from the rules.
U.S. Department of Justice, Criminal Division (2024, Sept). Evaluation of Corporate Compliance Programs
Exercise · Risk assessment
ISO 31000:2018. Risk management — Guidelines · COSO (2017). Enterprise Risk Management — Integrating with Strategy and Performance
Third party · Game 2
OECD (2014). Foreign Bribery Report · ISO 37001:2025, 8.2 Due diligence
Game 3
Respect the relationship, or influence the decision?
During a tender, a contract, or an inspection?
Does it exceed normal hospitality? Is it cash?
Can it be recorded and reported to management? Does it need to be kept confidential?
Reporting Channel and Culture
fraud cases were detected by tips — far more than by internal audit or management review. More than half of the tips came from employees.
ACFE (2026): 143 countries, 2,402 cases
If colleagues believe they will not be punished for admitting mistakes and doubts, problems surface early. A fearful team hides problems.
Phone and website — employees, partners and consumers can all use it.
Firing or harassing a person who reports is prohibited.
Management follows the rules itself, setting an example.
You will be told how your report was handled.
ACFE (2026). Occupational Fraud 2026: A Report to the Nations · Edmondson, A. (1999). Administrative Science Quarterly, 44(2), 350–383 · ISO 37002:2021 · Draft Law on the Legal Status of Whistleblowers (2021)
Metric
| Metric | What to show |
|---|---|
| Training participation, test scores | Whether employees know the rules that apply to them |
| Use of the reporting channel | Whether people can speak up — zero is not a good sign |
| Share of third parties checked | Whether third-party risk is being monitored |
| Number of repeat violations | Whether the corrective actions were effective |
| Time taken to close audit findings | Whether issues are resolved in a timely manner |
| Ethical culture survey | Whether employees trust management and can speak up about problems (Kaptein, 2008) |
Kaptein, M. (2008). Developing and testing a measure for the ethical culture of organizations. Journal of Organizational Behavior, 29(7), 923–947
Break 2
Next: three cases, the marketer’s checklist, conclusion.
Scan the QR code with your phone camera and enter your full name and student ID. Registration is open between 19:20–19:35.
Chapter III
The rules are written. Now it is your turn.
19:30 — 20:05 · 3 cases · checklist · conclusion
Case 1 · 10 minutes · Real
The China subsidiary of an international pharmaceutical company used “academic conferences” and trips for doctors as a key marketing tool. According to the authorities:
travel agencies, consultants
yuan — through the bribery channel
fine (2014)
Through agencies’ inflated invoices, “extra” money was paid out and given to doctors and hospitals. An anonymous whistleblower had warned management in advance. The division head received a suspended sentence and was deported.
Bribery: purpose — to influence prescriptions and sales; amount — far above actual cost; not transparent — hidden through third parties. Red flags: invoices above market rates, too many small agencies, expenses with no evidence of real meetings. Whistleblower: check the message, not the messenger — independent investigation, stopping the practice, approaching the regulator. Lesson: in December 2013 GSK announced it would stop paying doctors for promotional services and abolish individual sales targets for its representatives, implementing this in 2014–2016 — a step that reduces the “pressure” corner of the fraud triangle.
GSK China scandal — Changsha Intermediate People’s Court (2014, Sept 19) · U.S. SEC (2016). GlaxoSmithKline — FCPA settlement, $20 million · NPR (2013, Dec 17). GlaxoSmithKline to stop paying doctors to promote its drugs
Case 2 · 10 minutes · Real · AI
Samsung's semiconductor division allowed its engineers to use ChatGPT. Within about 20 days:
There was no easy way to delete data that had reached external servers. The company first limited each query to 1,024 bytes, then in May 2023 temporarily restricted generative AI tools and prepared its own internal tool.
The system, not intent: employees wanted to work faster — “shadow AI”. The missing elements: policy (what must not be entered), training (AI literacy), controls (an enterprise version, data-leak prevention tools). A total ban lowers risk in the short term but creates the risk of employees secretly using AI on personal phones. Marketers: do not enter consumer personal data, campaign plans, pricing strategy or contracts; transferring personal data to foreign services without consent is risky under Mongolian law. Under the EU AI Act, from 2025 organizations must take measures to support their employees’ AI literacy.
Bloomberg (2023, May 2). Samsung bans ChatGPT, Google Bard, other generative AI use by staff after leak · Tom’s Hardware / Economist Korea (2023, Apr) · Regulation (EU) 2024/1689 (AI Act), Art. 4, as amended by Regulation (EU) 2026/1744 · Law on Protection of Personal Information (2021)
Case 3 · 7 minutes · Real Mongolian case
On 14 May 2025 a listing on an illegal website offered to sell “data of 2.5 million Khan Bank customers”, and the National Human Rights Commission (NHRC) began an inspection on 16 May.
On 13 June the NHRC concluded that the bank’s systems had not been hit by a cyberattack; the listing was likely a fraudulent repost of altered data lost in 2021. Even so, it found that the bank had not taken adequate measures to protect customer data and that its public statement calling the reports “completely groundless” did not match the facts, and it issued 5 recommendations. No fine was reported.
Number claimed by the seller (unverified)
Bank account numbers exposed (NHRC inspection)
Recommendations: notify · take down · breach register · third parties · training
The system, not a hack: the weak elements were response, risk assessment and monitoring. Under the personal data law, a breach that harms data subjects must be notified to them immediately, and a breach register must be kept and submitted to the NHRC every year — exactly what the recommendations restate. Calling the reports “groundless” before the facts were established shows a missing incident-response plan and communication protocol. Preventive controls: share data with third parties only through secure channels and in the minimum amount; data-protection clauses and audits in contracts; logging of transfers; regular training for authorised staff.
P. Sainjargal, ikon.mn (2025.06.13), ikon.mn/n/3fhz · ubn.mn (2025.05.15), ubn.mn/p/83252 · Law on Protection of Personal Information (2021), Arts. 22, 24 · legalinfo.mn
Marketer and compliance
Check before an ad, post or promotion goes out.
Decision criteria
Does Mongolian law and the law of the relevant country permit this?
Would our policy and the partner's contract allow this?
Can you record this in writing and disclose it openly to management?
Whom to ask when in doubt? Deciding without asking is the biggest risk.
After today's lecture, has your answer changed?
Conclusion
Compliance is not a list of prohibitions — it is a system that helps make the right decision.
A program without a risk assessment is just paper.
A culture where people can ask and speak up is the strongest control.
For a selected company’s marketing activities, identify 3 compliance risks, rate them by likelihood and impact, and propose 1 control for each risk. 1–2 pages. You may use the risk matrix on this page.
Chapter IV
Home review section: flashcards, quiz, open questions, and a combined map of both lectures.
Self-study · flashcards · 18-question quiz · open questions · reading list
Exam Prep · 1
Click a card to see the definition.
Exam Prep · 2
Exam Prep · 3
| Lecture 1 · Marketing Ethics | Lecture 2 · Compliance | |
|---|---|---|
| Key question | What is right? | How to do the right thing every day, consistently? |
| Level | Individual decisions and choices | Organizational systems and procedures |
| Tool | Ethical theories, the 4 tests, Rest’s model | 6 elements, risk matrix, control checklist |
| Common risk | Misleading ads, dark patterns, greenwashing | Bribery, data leakage, third parties |
| Metric | Trust, brand, long-term value | Training, reporting channel, repeat violations, audit |
| The Marketer's Role | Truth, respect, responsibility | Line 1: check before publishing |
Exam Prep · 4
Practice by answering each question in 8–10 sentences.
Explain the difference and the link between ethics and compliance. Why is “our people are good people” not enough?
Compare Paine's (1994) compliance and integrity approaches. Which approach does the study by Treviño et al. (1999) support?
Analyze the Wells Fargo case using the fraud triangle. Which element did not work?
List the 6 elements of a compliance program, and explain which two are most often neglected and why.
Place 3 marketing risks of a chosen company on a likelihood-impact matrix and propose a control for each.
Explain the 4 criteria for distinguishing a gift from a bribe and apply them to the GSK China case. What third-party red flags were there?
Using the Samsung case, draft 5 clauses of an “AI use policy” for the marketing team and explain which program element each one relates to.
Connect the two lectures: propose a compliance control that prevents “true but misleading” advertising.
References and Materials
Reading the ★-marked items is enough to prepare for the exam.
★ Ferrell, O. C., Fraedrich, J., & Ferrell, L. (2022). Business Ethics: Ethical Decision Making and Cases (13th ed.). Cengage — Chapter 8.
★ Treviño, L. K., & Nelson, K. A. (2021). Managing Business Ethics (8th ed.). Wiley.
Crane, A., Matten, D., Glozer, S., & Spence, L. (2019). Business Ethics (5th ed.). Oxford University Press.
Murphy, P. E., Laczniak, G. R., & Harris, F. (2017). Ethics in Marketing (2nd ed.). Routledge.
★ ISO 37301:2021 · ISO 37001:2025 · ISO 37002:2021 · ISO 31000:2018
★ U.S. DOJ (2024). Evaluation of Corporate Compliance Programs.
U.S. Sentencing Commission. Guidelines Manual, §8B2.1.
IIA (2020). The IIA’s Three Lines Model.
OECD (2021). Anti-Bribery Recommendation, Annex II: Good Practice Guidance.
ACFE (2026). Occupational Fraud 2026: A Report to the Nations.
★ Paine, L. S. (1994). Managing for organizational integrity. HBR, 72(2), 106–117.
★ Treviño, L. K. et al. (1999). Managing ethics and legal compliance: What works and what hurts. California Management Review, 41(2), 131–151.
Weaver, G. R., Treviño, L. K., & Cochran, P. L. (1999). Corporate ethics programs as control systems. Academy of Management Journal, 42(1), 41–57.
Cressey, D. R. (1953). Other People’s Money. Free Press.
Becker, G. S. (1968). Crime and punishment: An economic approach. Journal of Political Economy, 76(2), 169–217.
Ordóñez, L. D. et al. (2009). Goals gone wild. Academy of Management Perspectives, 23(1), 6–16.
Tenbrunsel, A. E., & Messick, D. M. (2004). Ethical fading. Social Justice Research, 17(2), 223–236.
Edmondson, A. (1999). Psychological safety and learning behavior in work teams. ASQ, 44(2), 350–383.
Kaptein, M. (2008). Journal of Organizational Behavior, 29(7), 923–947.
Anti-Corruption Law · Criminal Code (2015) · Law on Combating Money Laundering and Terrorist Financing · Law on Protection of Personal Information (2021) · Law on Consumer Protection · Law on Competition · Law on Advertising · Labor Law (2021)
Text in force: legalinfo.mn · Oversight: IAAC, Anti-Monopoly Agency, National Human Rights Commission, Financial Regulatory Commission
U.S. DOJ (2020). Wells Fargo — $3 billion sales practices resolution.
U.S. DOJ (2008). Siemens AG — FCPA guilty pleas.
GSK China (2014) — Changsha court; U.S. SEC (2016) FCPA settlement.
Samsung (2023) — generative AI restriction after ChatGPT leaks (Bloomberg).
Regulation (EU) 2024/1689 — AI Act, Art. 4 AI literacy.
Irish Data Protection Commission (2023). Meta Platforms Ireland — €1.2 billion.
Your feedback
Fill in the fields below, then press “Copy” and send it to the instructor.
Enter your full name and student code, then click “Register”. One code can be registered once per day. Registration is open at .
Your quiz results and feedback are stored only on this device.
Compliance
INTD401 · LECTURE 2 · NUM BUSINESS SCHOOL
D. Bolortsetseg
AI Global — AI Marketing Trainer
NUM — business ethics, fundamentals of marketing
Standard Work Procedure — Prepare · Engage · Explain · Practice · Assess · Reflect
GSK China — bribery through third parties (2013–2014)
Samsung — ChatGPT and the data leak (2023)
The story’s decision options are for teaching purposes
Wells Fargo (2016–2020) · Siemens (2008) · Meta (2023) · Enron (2001)
Paine · Treviño, Weaver, Gibson & Toffler · Cressey · Becker
Ordóñez et al. · Tenbrunsel & Messick · Edmondson · Kaptein
ISO 37301 · ISO 37001 · ISO 37002 · ISO 31000
IIA Three Lines · U.S. DOJ ECCP · USSG §8B2.1 · OECD
Anti-corruption · Criminal · Anti-money laundering
Personal data protection · Consumer rights · Competition · Advertising
INTD401 students in the Tuesday and Friday groups
Good luck
REVIEW THE EXAM PREP SECTION AT HOME
Your choice is saved on this device. All fonts support Cyrillic.
Choose your section and jump straight there.
→ Space next slide · ← previous · M contents · N instructor notes · W whiteboard · F font · Home start · Esc close
On a phone: swipe left/right. Progress, quiz scores and feedback are saved on the device.