Hacker News Reader

Comment by cperciva | Hacker News Reader

First, when we started the company, Marc and I agreed that the company’s General Counsel would always report directly to me. This is different than in many technology companies where the General Counsel reports to the Chief Financial Officer.

This needs to be in bold 72-point font. Corporate behaviour aligns with corporate structure, and if the General Counsel is subordinate to the Chief Financial Officer, complying with the law will inevitably be secondary to making money.

If you want to avoid jail time, you should either have General Counsel reporting to the CEO or General Counsel / Chief Legal Officer appointed by and reporting to the board.

View on HN

A few years ago I was approached by a headhunter for a publicly-traded software company about coming on as their general counsel. We had lunch to talk about it; my prior experience in that role was a good match for what they needed.

The search for a general counsel, though, had been commissioned by the CFO, who was politically powerful within the company, and who wanted the GC to report to him. I told the headhunter that, especially because this was a public company, in my view the job would have to report either directly to the board, or to the CEO with a dotted line to the board; I explained why.

The headhunter said he thought that would be a problem but would check. He later let me know that what I'd said had killed the CFO's interest in me. I later saw in the paper that they'd hired someone else, who was reporting to the CFO. Best of luck to them.

Thank you for placing your professional responsibility ahead of getting a job. I wish there were more people like you.

GC is similar to a chief security officer in the need to be as independent as possible to look after the interests of the company and be free from undue pressure.

For companies covered by Sarbanes-Oxley there are circumstances where the General Counsel is legally required to escalate an issue to the board of directors, or a subcommittee of it. That's going to be difficult and awkward if he normally reports to the CEO. So while there are pros and cons to a plural versus unitary executive, at least for public companies, it makes a lot of sense to have the GC report to the board or a specific committee.

So while there are pros and cons to a plural versus unitary executive, at least for public companies, it makes a lot of sense to have the GC report to the board or a specific committee.

Yes, I'd say that from a governance perspective the ideal situation is to have a GC or CLO reporting directly to the board. In startups the board doesn't necessarily do as much governing as they normally would, though, especially in the case of a founder-CEO; in such a case of a dysfunctional board, having the GC report to the actual nexus of decision-making (aka the CEO) might work better.

What's the supposed rationale for the General Counsel reporting to the CFO in the first place? Isn't a General Counsel supposed to be "general" and not only concerned with financial issues?

Just the way the corporate org chart is drawn up.

Some companies have every C level executive reporting to the CEO.

Some CEO's are big picture people and focus on external issues. This means that the company would usually have most functions reporting to the COO.

Sometimes it just makes sense to have a group report to an executive. Consider Groupon, its largest expense is marketing so it might make sense to have the Chief Marketing officer report to the CFO. It can also make sense for financial companies to have the Counsel report to the CFO as they would be doing primarily financial related duties, like compliance.

General Counsel is a special case as its a bit of an oddball case for companies where its not a core function and will often report to the COO.

IT can often be like the general counsel where it's not viewed as a core function or PnL center and thus report to another C level executive like the CFO or COO.

There's really no good reasoning. Though many companies may do this, MOST (by far) companies do not.

For a lot of tech companies the primary area of responsibility of the general counsel is compliance reporting management (which is very closely aligned with CFO office). Outside of tech, there's often a lot more public policy work and critical incident management (which is why I often see them reporting through CEO outside of tech).

that rationale is that obeying the law is a financial decision rather than a moral decision. if the (money) price of breaking the law is less than the profit made by breaking the law, then the CFO will decide to do it.

this is THE classic example of corporate sociopathy. unfortunately its still the way a lot of companies do business.

You're confusing law and morality. I think the correlation is mild.

i'm not confusing them at all. not all laws are moral but the decision for a company to obey or disobey a law is still necessarily a moral decision.

It's not that simple. Running around thinking that CFO = evil sociopath is ridiculous. It's about motivation and accountability.

The story in the article is a great example, I don't think the CFO thought that she was breaking the law. It was a practice that she had engaged in previously, it was vetted by a big-5 accounting firm, and benefited the employees. The CFO was widely respected in the industry -- this wasn't some flimflam person or sociopath.

When your attorney works for someone else, that other party becomes the client. If you, as a CEO (or an individual) are ultimately accountable for the outcome of your decisions, you want the attorney working for YOU, so that you get unfiltered information to drive decisions.

my comment was a response to the question "why do some companies have the GC report to the CFO?". it was not about the company in the originally linked article, which obviously does not use this structure (and for good reason).

regarding that CFO from the linked article though, the federal prosecutor seemed to believe she was a criminal, and proved it enough that a jury agreed also and she eventually served jail time. we're not mind readers so we don't know how she felt about her actions, but honestly, it kinda looks to me like she really was a low level sociopath. just because she was surrounded by people who reinforced and validated her behavior doesn't mean she was acting morally.

I think this is a misuse of the word 'sociopath'. There are lots of things that are not strictly legal that we do all the time. Some of them result in in jail sentences (eg. possession of marijuana can hardly be called sociopathic).

I was not using sociopath as a synonym with "broke a law, any law". I was sociopath to mean "engaged in behavior that caused some level of harm to society". A low-level sociopath does something that causes a low level of harm to society. Accounting Fraud is a form of low level sociopathy, in my opinion.

How do you quantify jailtime in the 'price of breaking the law'? Also if the CEO has no knowledge of the CFO breaking the law, how can he be held accountable?

Speaking of quantifying stuff, if she only served 3 months that's not even that bad. Who knows how much money she made the firm over time; it may well be a net positive over all. And I'm sure she could be properly compensated for the jailtime.

Much of what a GC will do in a Silicon Valley company is support the CFO in ensuring legal compliance for finance and accounting. In this context, it can make sense for the GC to report to the CFO. In another sort of company where the legal issues might be more diverse, say a place like Wal-Mart that has complex labor and environmental issues in addition to the financial issues, this structure would be less appropriate.

Much of what a GC will do in a Silicon Valley company is support the CFO in ensuring legal compliance for finance and accounting. In this context, it can make sense for the GC to report to the CFO.

I'd say the exact opposite. If the GC is spending most of his time making sure that the CFO isn't doing anything illegal, the GC needs to report to anyone other than the CFO.

Yeah - they need to work together, but it doesn't seem like the GC should be in a position where they're being judged by the person they need to be watching. That's like the ratings agencies being paid by the banks they're supposed to be regulating...

I can't imagine how that could go wrong...

Often all or most administrative (read: non-revenue-generating, non-operational) functions for the company fall under the CFO--simply because the finance function is administrative but the CFO pretty much has to report to the CEO. The GC is administrative--as is HR, real estate, etc.--so they all often report to the CFO.

Indeed, even in medium-sized companies I/T will often be part of the CFO's department.

Fortunately I/T seems to be on it way out, though regrettably slowly.

Just curious, why's that fortunate?

I wrote, "Fortunately I/T seems to be on it way out, though regrettably slowly." Noblethrasher and odonnellryan asked what I meant.

I am referring to "I/T" as a corporate computing function within the company, a function which often hiders rather than accelerates the business.

I/T typically picks technologies which are easier for I/T. Hence there's a corporate standardization on one mail system, one OS; very strict upgrade cycles etc. This kind of made sense in an earlier era when computing wasn't really integrated into the business processes -- people would be "on email" and if the icons changed an expensive "training program" had to be rolled out because the majority of working people had a passive aggressive learned helplessness towards computers.

What happened is that people became more savvy and worked around I/T. First it was the PC: the appeal of the Apple II was that you could buy one, add a copy of Visicalc, plunk it down on your desk, and get work done without dealing with those assholes in I/T. I/T (this is before CIOs etc) fought back (just look at magazines like Datamation from the 1980s to see; I am not exaggerating) and took control of the PC infrastructure. Around 2000 departments would start to put in wifi access points and local file servers under secretaries' desks to just get work done. I/T again was seen as a barrier.

Nowadays I/T is freaking out about "BYOD" because people wouldn't put up with the crappy company-issued blackberries etc. But it is making business more efficient and humane.

You could see the nails entering the coffin for a long time, but these things take time. When I was at MIT in the 1980s I would get a laugh when I would run across a piece of literature from MIT's I/T department about the computing crucial capabilities they provided to MIT -- because they had nothing to do with the systems we depended on in the research labs which were mature and two generations beyond what I/T offered. And even now, heavily computer-intensive businesses often have disjoint departments and technologies for their customer-facing work and their internal systems (a few huge products like Oracle are rare exceptions).

Oh, I definitely agree. I've worked IT for a while. It definitely serves as a barrier to work (oh, you want access to THAT file?! No way! You need someone to request it for you...)

However, that's not because that's what we wanted to do. That's because someone had the bright idea to bring a paper to the CEO, and he said "We can't just have everyone accessing every damned file!!!"

Believe me, it's just as rough being the enforcer as it is being the one being enforced!

However, I think we'll need people to fix computers, update the servers, and wake up at 2AM to put a fan in the server room ;)

Seconded, where is IT going and why is that fortunate?

I would expect that the issue is that an aweful lot of work is going to be done in CFO territory in areas like accounting and securities law.

yes there are far more than just financial issues for a GC to deal with labor law is just one area that is in no way in the remit of the CFO - who basically is just a bean counter.

I bit OT, but I saw something similar once where the head of QA reported to the director of development. So the guy in charge of QA's annual raise/bonus/etc was himself compensated based on hitting release deadlines. I wonder how people here would have set that up differently.

One approach is to have Quality Control report to the Product Manager, who reports to Business Development. This might be doubly beneficial since it could help reign in promises that don't align with proven product direction. Also, what many companies call "QA" is really just QC, that is, checking the outputs. Quality Assurance is focused the production process itself, that developers are properly trained and that development/testing processes are competent.

One approach I've seen at Microsoft is to have Product Management, Engineering and QA report to the General Manager. It seemed like a very good solution to empowering QA. I'm guessing that structure evolved because of the need to ensure that Windows worked on a vast variety of plaforms.

I have run a team where the QA manager reported to me. We did not suffer quality issues - because my responsibility & goals were to deliver quality products not just to release dates. So it really depends on business and upper management support in doing the right thing and setting the right goals.

>I bit OT, but I saw something similar once where the head of QA reported to the director of development.

This isn't OT at all since most HN readers won't be CEOs of publicly traded companies. Your situation is far more common.

A good guide for this is how the FDA manages Good Manufacturing Practice (similar to ISO 9000 except focused on, you know getting shit done instead of getting hung up on the process). One important part is the distribution of responsibility. They get extremely upset by situations like the one you describe specifically because of the possibility of undue influence on the results. Manufacturing, R&D, QA and QC have to be organized to ensure proper independence.

(Which also means if you hear about scummy behaviour from a drug company: that flows from the top).

-d

PS: little known fact: the FDA has armed enforcement personnel who WILL storm through the door in some cases where they believe fraud could be involved in endangering people. I know of cases of this on the pharma side at least -- the food side may be more lax.

Precisely. Within ISO 9001/13485 certified companies, an individual (usually head of quality/regulatory) is designated the Quality System Management Representative. This individual is explicitly powered by the chief executive with the "responsibility and authority to ensure proper functioning of the quality system" and expected to 'pull the plug' when quality/compliance is at risk.

Shouldn't "do the right thing" be sufficient rather than overburdening the company with legal matters unrelated to the core business?

Misaligned incentives are a powerful thing. If you make it easier to do the right thing, more people will do it.

"Should", maybe; "is", no.

The larger the group of people, the more the structure of that group rather than the moral makeup of its members determines that group's behaviour.

One would think so, but there are a bunch of factors against once one gets close to something like the stock market. The two big ones are uniformity of financial metrics and honesty.

One of the huge problems in an unregulated stock market is that you have people exaggerating their financial position either because they aren't doing due diligence or because they are lying. Investors (including workers paid in stock options) have no way to evaluate the claims, and so you get exaggerated claims, false advertising in efforts to raise money, etc. We give some deference to those only seeking investment from small pools of friends or family, or those seeking help from venture capitalists who are presumed to be able to spot irregularities themselves, but on the stock market this is considered dangerous.

The second problem has to do with the convenience of stock analysts but is a related problem. The analyst always has less information than the CFO of the company he is analysing. Differences in ways of accounting lead to distorting effects as analysts read into them more of a difference than is justified by the facts. The stock market thus breeds a need for uniformity of accounting standards that small, locally supported and financed businesses do not need.

The result are things we call "securities law" which always includes "following the best practices from the relevant accounting organizations" (i.e. IASB or FASB depending on where you are).

Do the right thing is sufficient, on the other hand, if the business is a small one serving local markets and invested in by local individuals. It breaks down quite a bit as one tries to scale up.

Please define "the right thing."

Indeed very important, and this goes across industry.

What happens when the head of risk management and head of compliance report to business unit heads rather than functional lines? (See most big banks)

What happens when the local partner can overrule national standards committees? (See Arthur Andersen)

If the watcher reports to the watched, you're just going through the motions. Very informative.

In addition, big US companies apparently tend to have a very high CFO turnover rate...

Reply on news.ycombinator.com