How Stronger Communication Can Improve Compliance Training

“Think like a lawyer, talk like a human, and start with your audience."

Those three key principles drive Kirsten Liston’s innovative approach to compliance training, and it’s why we invited her to join us on our latest episode of Compliance Conversations!

Kirsten is the CEO of Rethink Compliance and a two-time author. As a journalist turned compliance enthusiast, she has a unique perspective on how to integrate strong communication principles into training.

We cover everything from Kirsten’s unlikely start in the compliance industry to why her background as a writer and communicator enhances her ability to design effective training.

Listen to our conversation, “Communication and Compliance – A Match Made in Training Heaven,” to find out:

• • Kirsten’s best hacks for improving your training programs
  • How to measure the success of your efforts
  • Tips to modernize your compliance training

Kirsten is a recognized leader in the field of compliance training, and her resources and books are used throughout the country. You can see a quick sample of a training video from Rethink Compliance here to learn more about their approach.

Her book, Creating Great Compliance Training in a Digital World, offers unique insights and strategies into developing attention-grabbing compliance training programs. She also co-authored The Compliance Entrepreneur’s Handbook: Tools, Tips, and Tactics to Find Your Killer Idea and Create Success on Your Own as a blueprint for those looking to launch their own compliance business.

Episode Transcript

CJ Wolf: Welcome everybody to another episode of Compliance Conversations. I'm CJ Wolf with Healthicity and today I have a good, wonderful colleague and friend, Kirsten Liston, who is here. Welcome, Kirsten! 

Kirsten Liston: Thank you, CJ. I'm so happy to be here.  

CJ: I am so excited to have you here. Kirsten and I have been doing some training, workshops, compliance training, workshops, 2-day workshops, it's for the Society of Compliance, corporate compliance and ethics, and the HCCA, the Healthcare Compliance Association. We've done a few of these. I know Kirsten like what; 6 or 7-8 now something like that?  

Kirsten: Yeah, I think that's right. One live about 5 or 6 virtual and a lot and another live 1 coming up.  

CJ: We do a few of these every year. So just keep your eye out for them if you're interested. It's a great two-day workshop where we just dive deep into talking about compliance training and how to make your compliance training effective and that's really what we're going to be talking about today.  

But before we get to that, I want to give Kirsten a moment to introduce herself. You know, Kirsten, we all come to compliance from these different paths and these different kinds of life decisions. I love to hear your story briefly on what brought you to compliance, what are you doing now, and that kind of thing.  

Kirsten: Yeah, I'm happy to answer that, CJ. And it's funny because you don't always realize you're starting a career when you're starting one. In my case, we're going to flashback to like the mid to late 1990s. I was an English major who was always interested in business but decided to kind of pursue my love of writing. And I spent the first five years out of college as a journalist. So, I wrote essays, and I wrote fiction. I kind of freelanced around Minneapolis trying to get some journalism credit, and I finally landed a full-time job at city pages, which at the time was the local arts weekly that was owned by the Village Voice, and for various reasons, I was realizing that journalism wasn't where I wanted to put my focus, so I was kind of casting about for things to do.  

And I knew I wanted my writing skills to be central to whatever job I took because honestly, they were what I was best at. I had a friend in Boston and I really wanted to move to Boston. And one thing led to another, and this little eight-person company in Boston was hiring an editor. They were a start-up and they had this mission of putting compliance training and now picture that we're in quotes “Online”, you know in 2000, which was the year that I joined, it was like, "What if there could be pet food but online?" You know, "What if there could be real estate but online?" And this was; "What if there could be compliance training but online?" And so, I took the job and I moved all my stuff to Minnesota. I was 27 years old and it was only on my first day in the office that I realized this little eight-person company full of very nice people had no customers, no contracts, and no revenue! And I thought, you know, and this was a world of dot com busts and like Internet companies that turned out to be based on nothing, and I just thought, "What have I done?"  

But 23 years later here I am and so it was a legit company and I'm so lucky I had this experience. I got into corporate compliance, specifically corporate compliance training, although then that eventually expanded to include other things, right as it was coming on the radar of most companies, you know, in the year 2000, typically a company didn't have a corporate compliance program unless they had this incredibly, ethically committed CEO and leadership team who really were forward thinking and wanted to embody their values, which let's be honest, is not all the companies out there, or they had gotten in a lot of trouble and been forced to have one by the DOJ or, you know, an equivalent government agency.  

CJ: Right!  

Kirsten: But it went in the first 10 years that I was in the space, it went from this kind of rare and specialized circumstance thing to everybody had it and I got to have a front-row seat as the compliance training industry stood itself up, integrity, which is Integrity Interactive is the company I joined, they grew to be one of the biggest providers in this space. And eventually were bought by SAI Global to become the number one provider in this space and for the first ten years, I just got a deep education and compliance and wrote stuff.  

And I created Integrity’s library which had 500 titles in it when it was sold to SAI Global, I built the team that built the library. So, I thought about all the moving pieces that were required to come out with a course, and along with client subject matter experts, you know a company would say to us in the early days; "We need an export course," and we'd say; "Great! bring your export experts together and let us learn how you talk to a global audience about it." But along with our clients, we figured it out, "What even is compliance training? How long should it be? How do you send a global message? How do you fold in translations and all that stuff."  

So anyway, that was my background. I spent 15 years total at integrity and SAI and then by about 2013, 2014, the compliance market had matured, most of these companies now had been running programs for 10 years, 13 years, 15 years, and they really wanted to see the products evolve. We've gone through this digital revolution with iPhones and social media. And tons and tons of digital tools available online to make great websites or interactive PowerPoint presentations.  

And there was this push from the market that, "What's next?" You know, we want our compliance training to be as modern and interactive as like the stuff my 11-year-old creates using software. And It's a whole other story in itself, but basically, the company I was at didn't want to move in that direction. In fact, when I made prototypes for new stuff that clients loved, they said "Stop showing these to clients they want to buy them!" I had spent enough time with clients and talking to clients that I thought, "This demand is not going away and I feel like it's something the market needs." So, I left and I opened Rethink and that was eight years ago.  

Today, Rethink has a team of, let's see, we're just hiring two more people, So 37 employees, but more contractors, but a team of about 40 people and we have 132 clients globally, our training rolls out to millions of employees every year in over 60 languages and we love partnering with companies, both big and small, to send a really, really impactful compliance message, we want your compliance messaging to get noticed, to move the needle to have an impact on culture. And we can do it in short and long forms. We also do codes and policies and have an advisory services group, so that's my story, where I came from, and where I am now.  

CJ: I love that story. We all just come from these different backgrounds, but we kind of find compliance and obviously, everyone listening can hear your passion there and you kind of find this interest in this passion. So grateful. And I didn't mention that you were the founder and CEO of Rethink Compliance, I should have mentioned that when I introduced you. We'll probably put a link there in the show notes for folks who want to learn more about that company and the services that you provide.  

And then we got together to start, doing these training workshops. I have just loved your approach and your perspective and your passion for all of this. So, let's talk a little bit about what we both like, which is compliance training. I want to first just ask you, "Why does it matter? Why does good training matter?" We've got policies, we're doing auditing, and compliance training is one of the seven elements, training and education, why does it matter?  

Kirsten: First, I'll say CJ, just to pick up on something you said, I have so enjoyed teaching these workshops with you and I feel like we both bring great, very complementary perspectives. You have the healthcare side of things. You've really studied how adults learn and other aspects of stuff, and then I can come in with my practical experience from making all this stuff. So, it's been a lot of fun to work together and I'm excited for many more workshops.  

But yeah; “Why does compliance training matter?” Compliance training matters because quite frankly, it's important that companies do this. I mean, I think I would say companies have a moral obligation to tell their employees not to break the law, both so they're good actors as companies and second to kind of protect employees, but kind of even more imminently, the Department of Justice has said, "It's important that you train people that they really understand it and that you can prove it's effective."  

And the design and approach and kind of strategy of compliance training matters because it's actually very hard to get adults to do anything. I think about, like New Year's resolutions, it's hard to get myself to do things, even when I'm bought in, even when I want to do those things, right? It can be hard, it can be inconvenient to make a change, and when you're trying to get not yourself, but other adults to change, it's not a one-and-done and it's not a simple process. That said, there are masters of it in the world and have been for a long time. The advertising world wouldn't exist if you couldn't persuade adults to kind of change their behavior, right? The marketing world wouldn't exist.  

But the fact of the matter is compliance training started as telling people the rules, telling people the rules, telling people the consequences, and it was important to educate people but for compliance training to really like matter and make a difference, you have to go beyond it to show people why this matters, why they should change. You kind of have to persuade them and you're not going to get anywhere unless you take that angle of it also.  

CJ: Yeah, and you kind of hit on this a little bit as you were sharing your background and what you observed and what you learned over the years. That this definition of good training has evolved over the past couple of decades.  

So, what are your thoughts on that? what was good 20 years ago is might not be good now and what's possible now that wasn't before? Any other thoughts on that? 

Kirsten: The first thing I'll say is when compliance training first stood itself up, it literally had to inform people about this stuff because, in a lot of cases, it was new, right? It wasn't a practice that you regularly educated people on this stuff, so they did just have to tell people the rules and kind of give them a lot of information. Also, we were limited to the tools we had at the time. The online training courses that I made in 2000, 2003, and 2005, those were cutting-edge at the time, right? The fact that you could get on your phone, this nicely at the time designed thing that you could click through and interact with and it could collect certifications, like that technology was great but moved on and kind of as I was saying about the digital revolution, our expectations as individuals for information change and I think changed substantially in lightning fast. I mean, I think about myself one of the things you talk about in the workshop is generational styles. I'm a good Gen-Xer and so when e-mail came out, I had been writing letters to my friends. So, I started writing long letters and e-mails and I did that for probably 15 years and then you know what, now I text my friends and we send each other. We have group texts and we have one-on-one texts and you send pictures and sentences but it is fragments compared to the emails that we used to send and quite frankly if I sat down and wrote one of those emails today, it would feel long, and if I received one of those emails it would feel long, instead, you kind of keep up with each other real-time.  

And so when you think about compliance training. The world of information has changed, and you kind of have to go with it. A big part of good compliance training is thinking about, "Who's my audience, and what is going to reach them?" And one thing to look at is; “How do people communicate today?” 

CJ: Those are such great points, and we're going to talk more about this and we're going to take a short break and we'll be right back.  

Welcome back, everybody from the break, we are talking about what makes good compliance training, and Kirsten Liston, founder, and CEO of Rethink Compliance is our guest, as you've been listening. We just finished talking a little bit about how the definition of good has evolved and what's possible now that wasn't possible before, and now Kirsten, if I could ask you just some kind of maybe practical questions like, "What are some hacks for making your training better?" If you could only focus on a couple of areas, you know we're so busy as compliance officers, we might not have a full-time compliance trainer or compliance, some organizations do, but if you're smaller, what are some of those hacks that you think we could start with?  

Kirsten: I love it. Yeah, because creating this stuff is time-consuming. Even customizing a vendor's stuff can feel time-consuming, unless the vendor is excellent and makes it easy on you, and quite frankly, compliance folks have tons of conflicting priorities, many of them very high priorities.  

So yeah, when you're looking to modernize your compliance training. The first thing I'll do is say, look around in the world at great examples of communications. I got really into and I'm still into explainer videos. You can in a 2-minute explainer video convey almost everything you would convey in like a 15-minute course. And there are infographics or whiteboard videos and there are vendors who offer those. So first, look around in the world and say, "What's a really captivating way to communicate rather than inventing it from scratch?"  

And then when it comes to developing your compliance messaging points, I kind of have 3 points. One is; “Think about what the law means, not what the law says.” A lot of early compliance training and even compliance training today was and is written by subject matter experts, and they sometimes fall into the I'll say, practice of wanting to tell you everything that's inside their head, wanting to tell you everything they know, almost like they're answering a test and have to be comprehensive. The average employee does not need that level of detail. They don't need to know what the law says. They may not even need to know the name of the law. They certainly don't need to know the history of the law, whether something is a per se violation or a different kind of violation. What they need to know is; "What does this mean for me?" And so a good way to think about training is to think about an executive summary, "How would I summarize this to my boss? Or to the head of the company? How would I boil this down into; here's what's at stake, here are some action items." And really start there, start kind of at the fundamentals and the basics, "What do I have to get across?" Because often it's less than you might think when you sit down to outline something. So, think about what the law means, not what the law says.  

Then I like to say, "Think like a lawyer. Like, know all this stuff, but talk like a human." So, put things in simple words, how would you explain this to a really smart 12-year-old? You know, do you have these really long kinds of complex sentences and many, many bulleted lists?  Or, can you boil it down into a sentence? and can you put it in kind of common sense, plain language? Like look, “When it comes to conflicts of interest, we all have a responsibility to this organization. And when our personal interests get in the way of that obligation, it's a problem. So, let's talk about how that can come up and what to do about it," that kind of thing. And then, yeah, oh, sorry. Were you going to say something, CJ?  

CJ: No, no, I just completely agree with that.  

Kirsten: And then the third point is; kind of take a marketing and advertising approach, "Don't start with what you want to say, start with your audience. Who are they? What do they care about? And what part of your message could be interesting to them, could be engaging to them, could be relevant, like think about; who is this person I'm trying to reach? What matters to them, and how can I start with something that shows them I understand what matters to them and kind of capture their attention before I kind of start broadcasting."  

So, those are my three tricks. I mean, first, look around in the world and choose good formats. But what the law, you know, think about what the law means, not what the law says. Think like a lawyer, talk like a human, and start with your audience.  

CJ: Yeah, I love that. And we dive deep into those in the workshops and one other thing that as you were talking maybe kind of think of some of my experiences was, I try to train people to issue spot, meaning they don't need to necessarily know all the nuances, but if they can know they are in this territory of; "Oh! This might be you know anti-bribery, or Oh! this might be a privacy violation," if they can sense that they're in that space and then they know who to go to.  

So, you have compliance people to be experts and to be up on the latest changes in the rules and regulations. You don't expect your employees to know all those nuances. But if they can issue spot and if your training can help them just say like; "Oh, I'm in the compliance space, I'm going to reach out to my compliance expert." I think that is another example of less is more.  

Kirsten: Yeah, I love that. And one of the things that can be counterintuitive when you first start thinking about it is; in the less is more and just equipping somebody to issue spot and then know where to go, that might be more memorable than trying to teach him a whole lot of other stuff, and what really matters, isn't what you say, it's what your audience is going to take away from the training experience. And so, if boiling it down like that, helps them take away like a clear understanding of; "This is what happens. This is what I need to look for and this is where I need to go if I do," I mean that's a win!  

CJ: I always started a lot of my training with; "Here's my phone number and here's my e-mail. This is the most important thing you can learn today," and then I would end the training with the same information, and then sandwiched in between is kind of my content but look; "If you don't get everything and you don't remember all the details six months from now, at least remember I'm here, and reach out to me because then we can rehash the details," and that sort of thing.  

Kirsten: Yeah, I love that! I love that!  

CJ: Now, one thing that we get a lot is people want to measure their training, like how do they know it's working and what are some, you know, how do I measure effectiveness in my training? Any thoughts on that? You know, we hear this question all the time; "How do you measure, whether it's working," and any practical strategies that you are aware, that you're using or other people might be using?  

Kirsten: Yeah, it's funny. I literally got asked this question an hour ago. I was talking with a company that's coming to talk to us about training and they said to us; "How do you know if this training works? Like, if you roll something out, how do we know if it was successful?" And we at Rethink decided to tackle the question of data and analytics both; "What do you capture? What does it mean and how do you even make this come alive for clients?" We decided to start tackling this in 2020. So, since 2020 we've offered a way both in our courses and then in our digital codes of conduct to not only send out information, which it's a great broadcast mechanism, you get the information out to everybody, but to also capture it back. And we spent a lot of time talking to compliance professionals. We don't like to sit in a room and come up with big ideas and presume that we know how our clients are thinking. We like to go out there and really understand what is on people's minds. And our number one kind of aha moment is that compliance officers, especially people who have been doing this for a while, they already know what to look for in assessing their program, and they've already done it to some extent. They've done program assessments, they've done risk assessments, they've done cultural assessments or cultural surveys. They've walked around taking the temperature of their location and other locations, and they've told people about the use of code of conduct and other resources. People know as compliance professionals what they want to measure. What has been missing in compliance is the ability to put hard data behind it. To not just say; "You know what? I visited all of my company's locations and I feel very good that there's a general awareness of the hotline and people know where to go and they feel comfortable speaking up," that's like one answer and it's better than nothing but a better answer is to be able to say; "We asked everybody in the company and 92% of people knew how to find the hotline. We think that's successful and in subsequent years, we're going to work to try to get that number over 95," and we asked the whole company and 82% of people felt comfortable speaking up, but 9% said; they believed that they were afraid of retaliation or seen retaliation, we need to work on that. So, we have this number, we're going to take some actions and we're going to measure again.  

So, what I would say to compliance professionals out there who are trying to figure out how to measure their programs, you probably are already regularly, frequently, and in an ongoing way trying to assess the effectiveness of all this stuff. All the stuff I mentioned are people using our code. Do they know about the helpline? Do they believe the company is committed to integrity? Now think about how you can put data behind it and if you want to come talk to me, I'm happy to show you how we've done it in our courses and in our digital codes because that might give you some ideas too. 

CJ: On this question, I think there are also different levels. So, like most of us have general compliance training that you might give to new employees and to all employees. And then there are, of course, focused training, maybe by job type, because there are higher risk employees or not the risk that employees not higher risk, but the activities they're involved in could be higher compliance risk and then one other area that I dealt a lot within healthcare is medical coding and billing is kind of one of the biggest risks in healthcare.  

So, we would audit the providers; doctors, we would audit their medical records and the codes they choose. And part of our training would be focused on; "Ohh that doctor's audit didn't come back very well," so we'd go out and train. I call it; The Audit Educate Cycle, where you're auditing and then you're educating to what needs improvement and then you audit again to see if that improvement has occurred. And so that's also one way to measure because, at the end of the day, we're trying to get them to change behavior, not just; "Ohh, let's do a test and see do they understand the material." Somebody can understand the material and still choose not to do it. And so, behavior hasn't changed!   

Kirsten: Yeah, exactly! Knowledge is one piece of the puzzle and you can't get anywhere if they don't have some basic knowledge, and it's useful to be able to assess that they have some basic knowledge, but like you said, how long isn't enough? Did it affect the culture? you know, is it what is peers are saying to each other? Is it what managers are reinforcing? And is it reflected in what people do? And so being able to audit, not just as you say, knowledge or even cultural feelings, but behavior, matters. And it'll be different for every kind of industry, organization, and collection of risks. But when you start asking yourself those questions, you can sometimes have opportunities open up you didn't even think about.  

CJ: Exactly! This has been so fascinating. The time has just flown by. We're getting towards the end, but I want to give you an opportunity to have any wrap-up comments or thoughts. Also, maybe I'll ask if you're comfortable, you can tell us about your book, I think you have a couple of books. Any last-minute thoughts or information on those books that you want to share?  

Kirsten: Yeah, you know what? I'll do both. I'll first say that, yeah, I have two different books kind of written for two different purposes and two different audiences. And CJ, I'll send you the link to put in the show notes. The first book is on compliance training. So, if you've enjoyed what you've heard between me and CJ today, and you want to say; "I want to read a whole book about creating really great compliance training that reaches people and has an impact." It's called; Creating Great Compliance Training in A Digital World. The subtitle is; “How to Reach and Persuade Your Workforce.” And that is sold by the SCCE. So frankly, if you Google the title, you'll find it, or you can go on the SCCE's website. But I wrote that book for and with the SCCE, and so it's sold by them.  

And then, you know, I had so much fun starting the company and also there's so much to know and so much to learn, and so much to figure out, and so much to decide that I got together with two different entrepreneurs in this space, one of them is Joe Murphy, who actually was one of the founders of Integrity, where I got my start and one is Christie Grant Hart, who founded Spark Compliance, around six months from the time I started Rethink, they were a bunch of compliance companies that started in that time.  

But the three of us got together and put down in writing; “How Do You Start A Compliance Business.” And I have since heard that it's been useful for people who have any kind of professional services business. A compliance contact that I have given a copy to his wife, she was opening her own law firm, but it's everything from how do you decide what to do? What do you do before you leave the job at to help ensure success for your new venture? What do you decide about taking on Co-founders, and hiring? How big do you want to be? How do you do marketing? How do you do sales? How do you figure out the back-end finances of the organization, including bookkeeping resources and stuff like that? It really is just our mental download of; "Here's everything we wish we knew on day one when we had this glimmer of an idea to start the business." So those are the two books.  

And then for closing thoughts, I'll say I just love that our industry is asking itself the question; "How do I make better training?” and some of it is kind of intrinsically driven. Compliance professionals want to give their employees a good experience. They want to make good use of their time. Some of it is externally driven by the DOJ saying; "Don't just have a paper program in place, have something that actually works." But it's a very different question than we've been asking ourselves at the very beginning of compliance, the kind of the question was, "Do you have these program elements in place?" Now it's, "Do you have them and are they working?" So, my closing thoughts are just to say, it's not a simple question to answer. It's kind of a different answer for every organization. It's not a one-and-done, but it's a really fun thing to work on, right? to try your best to communicate with your audience then stop and assess and evaluate how you did, and then feed that feedback into the next one. So, a lot of this is going to be an incremental journey. You're going to be getting better over time, but our whole industry is doing it at the same time, so it's a kind of fun to evolve together.  

CJ: Yeah, I couldn't have said it better. This was so wonderful. I appreciate your expertise and all your years of experience and just your passion. And I want to just tell everybody that you are a wonderful businesswoman, but you're even a better person and I just appreciate your integrity and the way you approach all of this. So, thank you so much for joining us today.  

Kirsten: CJ, thank you, and thank you for the kind words. I loved being on this podcast.  

CJ: Well, thank you everybody for listening to another episode of Compliance Conversations. If you enjoy these, please share it with friends and colleagues and until next time, please be safe and practice good compliance. Take care, everybody!