Corporate governance in practice: the role of practitioners' understanding in implementing compliance programs

Abstract

Purpose

This article investigates the implementation of a compliance programme (CP) in terms of how practitioners conceive of and execute the responsibilities arising from this corporate governance mechanism.

Design/methodology/approach

This study involves a practice lens approach forms the case study analysis and interpretation, involving both interviews and documentary materials collected from an Italian company with prolonged compliance experience. Schatzki's (2002, 2010) practice organisation framework guides the interpretation of CP as a practice organised by rules, practical and general understandings and teleoaffective structures.

Findings

CP practice evolves over time. A practical understanding of daily actions required to accomplish the CP and a general understanding of the responsibilities connected with the CP, such as the attitudes with which the CP is performed, are mutually constitutive and jointly favour this evolution. Dedicated artefacts – such as IT platforms, training seminars and compliance performance indicators – help spread both of these types of understanding. These artefacts also align practitioners' general understanding with the CP's teleoaffective structures imposed, including the CP's assigned objectives and the desired reactions to them.

Research limitations/implications

The findings have theoretical and practical implications by revealing the relevance of practitioners' understanding of corporate governance mechanisms in their implementation processes.

Originality/value

This study reveals the potential benefits of practice lens approaches in corporate governance studies. It responds to the call for qualitative studies that demonstrate corporate governance as implemented in daily activities.

Citation

Stacchezzini, R., Rossignoli, F. and Corbella, S. (2020), "Corporate governance in practice: the role of practitioners' understanding in implementing compliance programs", Accounting, Auditing & Accountability Journal, Vol. 33 No. 4, pp. 887-911. https://doi.org/10.1108/AAAJ-08-2016-2685

1. Introduction

Corporate governance (CG) is broadly defined as the “procedures and processes according to which an organisation is directed and controlled, [coherently with] the distribution of rights and responsibilities among the different participants in the organisation” (Organisation for Economic Co-operation and Development—OECD, 2007, p. 151). Furthermore, CG has been increasingly scrutinised by critical and interpretive accounting scholars (Ahrens et al., 2011; Gendron, 2018; Parker, 2018), also in historical perspective (Shah and Napier, 2019). They have aimed to broaden the CG research scope by adopting theoretical frameworks that might surpass a schematic interpretation of CG functions (Roberts et al., 2005; Parker and Nielsen, 2011). Similarly, there are calls for qualitative research that can open the “black box” of CG (Ahrens and Khalifa, 2013) and explore how practitioners conceive of and execute the responsibilities related to CG roles and mechanisms (Parker, 2018). Indeed, “[t]he processes by which perceptions are conditioned, attitudes formed, behaviours practised and power and control are wielded (often being the prime interest of journalists, regulators and the wider community), are seemingly ignored by accounting researchers claiming to advance the cause of effective corporate governance” (Parker, 2018, p. 284). Furthermore, accounting scholars should aim to enrich the “traditional” views of CG, which are predominantly based on an agency theory approach and almost exclusively focus on resolving conflicts of interest between corporate management and stakeholders (Brennan and Solomon, 2008). Even historical perspectives on CG demonstrate a great potential, beyond the accounting history research agenda. Indeed, the variety of settings and the modalities of CG practices observable in the past can illuminate our understanding of contemporary CG and its relations with accounting (Lai et al., 2019, p. 328).

Some studies have seized the opportunity to embrace broader research approaches to CG beyond those that are traditional, predictive and predominantly quantitative (Brennan and Solomon, 2008; Hambrick et al., 2008; McNulty et al., 2013; Parker, 2018) by elucidating the potential of a practice lens approach in exploring how CG is implemented (Ahrens et al., 2010, 2011; Ahrens and Khalifa, 2013; Brennan and Kirwan, 2015). A “practice turn” appears in various social science disciplines (Cetina et al., 2001; Whittington, 2006, 2011; Simpson, 2009; Brown, 2012; Schatzki, 2018); furthermore, practice theory is also helpful in raising many context-specific research questions regarding CG (Ahrens et al., 2011, p. 320). Moreover, interpreting CG as a practice opens the “black box” of organisations by providing an understanding of corporate boardrooms' actual functions, among other governance structures and mechanisms (Ahrens and Khalifa, 2013). This also facilitates a focus on how practitioners perceive, interpret and adapt CG rules to convert them into activities (Brennan and Kirwan, 2015, p. 469). This may also enhance our understanding of how practitioners at different levels – such as boards of directors, management teams and other organisational members – respond to the regimes of accountability imposed by CG rules, and in practicing these rules, they ultimately change them (Ahrens et al., 2010, p. 10).

The practice lens approach developed by Theodore R. Schatzki (1996, 2001, 2002, 2005, 2006, 2010), an eminent professor of philosophy, has been particularly helpful in exploring CG functioning. Specifically, this has compelled scholars to capture the collective structures of knowing, reasoning and understanding (Reckwitz, 2002) that transcend single individuals and pertain to CG practices. Scholars interpreting CG practices as sets of actions practitioners “mentally organise” (Schatzki, 1996, p. 56), can elucidate how these actions are “organised” by practitioners' understanding of CG objectives, rules and duties. Ahrens et al. (2011, p. 231) particularly urge an exploration of practitioners' “practical understanding” regarding how to execute CG-related interactions, processes and tasks; without such an understanding, “corporate governance remains an incomplete practice”. Nevertheless, the exhortations to adopt practice theory to empirically explore CG practices (Ahrens et al., 2010, 2011; Ahrens and Khalifa, 2013; Brennan and Kirwan, 2015) have yet to be heard. Although there is a growing number of accounting scholars that have adopted Schatzki's theory to provide empirical insights on accounting and risk management practices (Ahrens and Chapman, 2007; Jørgensen and Messner, 2010; Nama and Lowe, 2014; Bui et al., 2019), to the best of our knowledge, no prior studies has incorporated Schatzki's approach using CG practices as an empirical setting. This may be due to difficulties in collecting insights about the actual functioning of CG processes (Parker, 2018). The present research aims to fill this gap.

This research's empirical setting involves the corporate implementation of a compliance programme (CP) or a CG mechanism that requires all company employees, managers and directors to be accountable for certain actions and controls according to the behavioural rules established by an organisation's overall codes of conduct (Weaver et al., 1999b). The present article draws on Schatzki's practice theory to develop a theoretically informed narrative of the empirical materials provided by an Italian pharmaceutical company, henceforth “Pharma 101”, for confidentiality. This company adopted a CP starting in 2005 in accordance with the Legislative Decree No. 231 of 8 June 2001, an Italian regulation introducing corporate crime liability [1], hereafter “LD 231”. Applying a CP has considerable relevance in this context for several reasons that relate to its location as this Italian company is subject to the corporate liability penalties introduced by LD 231 (i.e. financial sanctions and debarment from business activities); industry, as the Italian pharmaceutical industry is highly regulated, and the Italy's Association of Pharmaceutical Companies provides CP guidelines that Pharma 101 follows; and ownership structure, as Pharma 101 is controlled by a global healthcare company that requires its subsidiaries to adhere to its ethical and compliance policies.

This analysis parallels Schatzki's work by exploring how CP implementation unfolds as a practice “organised mentally” by practitioners (Schatzki, 1996, p. 56). In particular, the research elucidates how practitioners conceive of and execute CP-related responsibilities. As the CP is a CG mechanism that involves engagement by all corporate employees, managers and directors while they execute their activities, we posit that investigating CP implementation processes through a practice lens approach particularly contributes to elucidating CG's actual daily functioning (Ahrens et al., 2011; Ahrens and Khalifa, 2013; Roberts et al., 2005; Parker, 2018). Intrinsically, the study has both theoretical and practical implications by offering empirical insights on practitioners' understanding of CG mechanisms in their implementation process.

This article proceeds as follows: Section 2 introduces CP logic and reviews extant literature on CP practices. Section 3 presents this study's theoretical framework and Section 4 describes the methodology, including the empirical setting and how the evidence was collected and analysed. Next, Section 5 contains the main findings from the case study of CP implementation. Section 6 discusses the main findings, and Section 7 concludes by highlighting this study's contributions, some limitations and suggestions for further research.

2. Compliance programme practices

Compliance programmes have become increasingly prevalent worldwide and especially following the passage of various national regulations – such as the United States' Sarbanes–Oxley Act, Australia's Corporate Law Economic Reform Program Act and South Africa's King Report on Corporate Governance – in response to fraud scandals (Francis and Armstrong, 2003; Beale and Safwat, 2004; Svensson et al., 2009). These types of CG mechanisms have been particularly emphasized in such regulated trades as the financial, insurance and pharmaceutical industries (Bartrum and Bryant, 1997). Furthermore, several international agreements have been established in response to growing corruption due to markets' opening and globalisation processes including the following: the Convention Protecting the European Union's Financial Interests – Fight Against Fraud (Brussels, 26 July 1995) and its first protocol (Dublin, 27 September 1996); the Convention Against Corruption Involving Officials (Brussels, 26 May 1997) and the OECD's Convention on Combating Bribery of Foreign Public Officials in International Business Transactions (Paris, 17 December 1997). In line with these agreements, some countries have adopted corporate criminal liability regulations, such as the Italian LD 231; Spain's 2003 Ley Orgànica Numero 15, with updates in 2010 and in 2015 and the United Kingdom's Bribery Act of 2011. Each national regulation influences CP in coordination with the local penal system. Therefore, the facilities that companies may use to implement a CP meet locally regulated legal requirements.

Moreover, CPs create regimes of accountability (Volkov, 2015; Jones, 2017) under which all employees are required to standardise their behaviour “within the domains of ethics and legal compliance” (Weaver et al., 1999a, p. 42). The CP also assigns them various roles and related responsibilities to prevent misconduct. As individuals or body members, the employees involved include the board of directors and CEO; the “supervisory body” to which LD 231 assigns the monitoring of CP implementation; members of departments, such as the compliance officer, internal auditing and legal officer and managers and employees working in business departments [2]. Within their oversight functions, governance bodies are also required to train employees and managers in codes of conduct and compliance with these codes; exert (third-level) controls to avoid misconduct and establish disciplinary systems to be applied in the case of misconduct. Specifically, the board of directors is responsible for adopting the CP, and the CEO is directly involved in the necessary actions towards its implementation. The supervisory body monitors CP implementation and reports its effectiveness to the board of directors. Staff departments can support the supervisory board and CEO by performing controls in their daily activities. Managers of business departments are responsible for their activities as well as those performed by the employees within their departments. Consequently, business managers impose (second-level) controls on employees' activities. However, employees are personally responsible for their individual actions and should implement concurrent (first-level or self-) controls that deter misconduct.

Academics have explored CP practices from various research perspectives, including business ethics and business law and management (e.g. Weaver and Treviño, 1999; Schwartz, 2004; Arjoon, 2005; Parker, 2006). However, such practices remain unexplored within accounting literature (Brennan and Solomon, 2008). Previous studies highlight the need to investigate practitioners' motivations, perceptions and incentives to understand how these programs function. For example, Weaver and Treviño (1999) demonstrate that employees' perceptions of programs affect how these programs are implemented. When employees perceive CP as a program to help their decision-making, with ethical advice and counselling, they are more prone to engage in its implementation and report misconduct. MacLean and Behnam (2010) highlight the dangers of decoupling CP from core business activities, as practitioners respond to this decoupling in their CP implementation. According to Kaptein (2011a, b), codes of misconduct are embedded among senior managers and other employees; furthermore, Schwartz (2004) demonstrates that codes of conduct's content and procedural aspects – such as their examples, senior management support and training – influence practitioners' perceptions and behaviours. Similarly, Singh (2011) indicates that managerial perceptions of these codes' “effectiveness” in deterring misconduct depend on how the codes are implemented and communicated within organisations.

In summary, these studies highlight that practitioners' motivations, perceptions and incentives affect CP implementation, and how CPs are implemented affects their behaviour. However, no prior research to the best of the authors' knowledge has explored how practitioners perceive the CP during its execution. In Schatzki's (2001) words, no prior studies have detailed how CP implementation unfolds as a practice that practitioners mentally organise. Thus, we draw on practice theory to fill this gap as we are unaware of any prior studies that have adopted a practice lens approach to investigate this CG mechanism.

3. Theoretical frame

This section introduces the key concepts Schatzki developed in his approach to practice theory. It also reveals pertinent key studies adopting Schatzki's works as a theoretical reference and highlights practice theory's potential in CG research.

3.1 Schatzki's approach to practice

Since the 1980s, contemporary social theory has taken a “practice turn”, largely due to seminal works by such distinguished scholars as Pierre Bourdieu, Michel de Certeau, Michel Foucault and Anthony Giddens (Whittington, 2006; Miettinen et al., 2009; Brown, 2012; Hui et al., 2017; Schatzki, 2018). As common denominators, these theorists examine the consequentiality of everyday actions in the production of the social order, the rejection of dualism and the dualities of structure and agency and cognition and action and mind and body (Feldman and Orlikowski, 2011). Moreover, practice theory posits that “social orders (structures, institutions, routines, etc.) cannot be conceived without understanding the relevance of agency in producing them, and similarly, agency cannot be understood ‘simply’ as human action, but rather must be understood as always already configured by structural conditions” (Fieldman and Orlikowski, 2011, p. 1242).

Schatzki is a “central interlocutor” of practice theory (Caldwell, 2012, p. 2), as his approach to practice is rooted in the idea that “social order is established within the sway of social practices […] and mind is a central dimension of this “process”” (Schatzki, 2001, p. 50). This is because the “mind is a “medium” through which practices are organised” (Schatzki, 2001, p. 61). Specifically, Schatzki's (2002, 2010) “practice organisation framework” describes practices as sets of actions linked through and organised by four principles, also labelled “properties” or “dimensions” as follows: practical or general understandings, rules and teleoaffective structures [3]. First, practical understanding involves the abilities related to actions that comprise a practice, which implies that one will know how to act regarding some given practice. Individuals equipped with these abilities know what to do to perform a certain practice or “knowing how to X, knowing how to identify X-ings, and knowing how to prompt as well as respond to X-ings” (Schatzki, 2002, p. 77, emphasis in the original). Furthermore, Schatzki (2002, p. 88) notes that practical understandings alone rarely determine action, except for “disperse practices” or such simple actions typically organised only through practical understanding as acts of describing, ordering, explaining and reporting. “Integrative practices” involve “multiple actions, projects, and emotions” (Schatzki, 2002, p. 88) and typically also require other organising properties.

Second, rules are explicit formulations that combine particular actions, such as laws, rules of thumb or unwritten rules and other prescriptive judicial remedies. They are formulated and applied to either control current activities or cause specific effects. Rules connect the action of a practice to the extent that actors adhere to it: “rules do not determine what people do; rather, what people do determines what following rules amounts to” (Schatzki, 1996, p. 298). However, similar to practical understanding, rules “only intermittently and never simpliciter determine what people specifically do” (Schatzki, 2001, p. 60).

Third, teleoaffective structures include two components including teleology and affectivity. Teleology refers to the goals in performing a practice, while affectivity involves its accepted or prescribed emotions and moods. In summary, a teleoaffective “‘structure’ is a range of normativised and hierarchically ordered ends, projects and tasks, to varying degrees allied with normativised emotions and even moods” (Schatzki, 2002, p. 80). Even if evenly incorporated into actors' minds and actions, teleology and affectivity are the practice's properties rather than those of the actors. These also refer to the objectives and emotions that are deemed mandatory or acceptable. Fourth, general understandings represent an overall holistic understanding, and are expressed as the manner in which people carry out projects and tasks (Schatzki, 2002, p. 86).

Variations in the practice organisation's principles determine how their practices evolve, as they also evolve with time in response to practice-related events (Schatzki, 2002, p. 104): “practices are not static. They evolve as circumstances change, opportunities and problems arise, personnel changes, new ideas arise, and so on” (Schatzki, 2005, p. 475). The actions that constitute practices are inescapably – and often fundamentally – entwined with “material entities” (Schatzki, 2002, p. 16), or people (human beings), artefacts (“products of human action”), organisms (“life forms other than humans”) and things (“non-living entities whose being is not the result of human activity”) (Schatzki, 2002, p. 22). These material entities facilitate such practices to “transpire” and work with them to mould the social order (Schatzki, 2005).

3.2 The critique, adoption and potential of Schatzki's approach

Schatzki's approach to practice has been subject to various critiques (Caldwell, 2012; Welch and Warde, 2017) that relate to both its ontological and epistemological stances. For instance, Caldwell (2012) argues that Schatzki's account not only overlooks the relationship between agency and practice but also underestimates the relevance of discourse and language in moulding practices. Furthermore, critiques refer to the opacity of some concepts and particularly that of general understanding (Caldwell, 2012; Welch and Warde, 2017).

With these critiques, several scholars have begun to operationalise and refine Schatzki's account. Specifically, Schatzki's approach to practice has made its entrance into the accounting literature due to Ahrens and Chapman's (2007) pioneering contribution. Jørgensen and Messner (2010) later indicated that accounting can help mould practitioners' general understanding within the strategic context of new product development practices. Furthermore, Nama and Lowe (2014) contributed to the understanding of accounting within private equity practices by theoretically advancing the concept of general understanding. More recently, Bui et al. (2019) demonstrated how general understanding has forged changes in risk management practices.

Some scholars have also elucidated the practice lens approach's potential in studying CG (Ahrens et al., 2010, 2011; Ahrens and Khalifa, 2013; Brennan and Kirwan, 2015). Moreover, the practice lens has been deemed helpful in “captur[ing] the dynamic, interactive nature of governance”, which consequently limits the “dangers” of studying its “appearance” (Brennan and Kirwan, 2015, p. 467). From a practice theory perspective, such “structural” elements of CG as its regulations, firm governance policies and daily policies and procedures (Brennan and Kirwan, 2015, p. 470), are interpreted as “resources of a practice that practitioners, in drawing upon them, can change […] through the adoption and adaptation of activities, ideas and tools” (Ahrens et al., 2011, p. 318). Practitioners are not passive subjects of CG implementation processes as they “respond to regimes of accountability and can contribute [to] shaping them” (Ahrens et al., 2010, p. 10).

Moreover, studying how CG operates “in practice” involves investigating the practitioners' capabilities and initiatives to translate governance rules into organisational activities (Whittington, 2006; Brennan and Kirwan, 2015) according to how they conceive of governance roles and actually execute their related responsibilities (Parker, 2018). However, rather than focusing on individuals' perceptions, motivations and incentives, research influenced by practice theory has adopted CG practices as a “unit of analysis” (Ahrens et al., 2010, p. 2) to demonstrate how CG practitioners share an understanding of the actions to execute CG mechanisms. This should provide a more thorough perspective of CG functioning given that “if [corporate governance] wants to become a functioning practice, [it] must develop practical understandings that enable practitioners to connect principles and rules more effectively. Practical understandings are complexes of know-how, and they have been neglected in the corporate governance discussion thus far” (Ahrens et al., 2011, p. 319). Schatzki's (2002) account of practice should facilitate analyses of the practical understanding of CG mechanisms as this account perceives practical understanding as a practice-organising principle.

Despite practice theory's highlighted potential for CG research, no prior studies to the best of our knowledge are based on such direct empirical explorations. Indeed, Brennan and Kirwan (2015) reviewed prior studies on audit committees, while Ahrens et al. (2010) developed their arguments based on prior research of boards of directors and audit committees. The contribution by Ahrens et al. (2011) is deductive and not empirically based, while Ahrens and Khalifa (2013) underline the importance of studying CG practices based on a review of three qualitative field studies. This study fills this gap by adopting Schatzki's practice lens approach to empirically explore how the CP practice unfolds as sets of activities that practitioners “mentally organise” (Schatzki, 1996, p. 56).

4. Methodology

This section describes the empirical setting by introducing the case study company, its CP practices and the regulatory context in which the company applies this CP. The section then explains how evidence was collected and analysed to develop a theoretically informed case narrative.

4.1 The empirical setting

This study explores CP practices by examining empirical materials provided by Pharma 101, an Italian pharmaceutical company that adopted a CP in accordance with LD 231 in 2005; the company routinely updates its CP to match legislative updates and the organisation's specific needs. Pharma 101 belongs to one of the largest pharmaceutical groups worldwide and delivers health solutions through its prescription medicines, vaccines, biological therapies and animal health products, which it markets both directly and through its joint ventures. Currently, Pharma 101 directly employs approximately 200 people and indirectly employs an additional 1,200 people through its Italian subsidiaries.

Applying a CP is considerably relevant to Pharma 101 for several reasons. First, as an Italian company, Pharma 101 is subject to the corporate liability introduced by LD 231. Specifically, LD 231 offers companies a means to avoid responsibility in the case of employee misconduct, if they can prove it despite what any individual employee has done; the company has implemented a type of CP specified by LD 231 or the purported “231 model” [4, 5]. Considering the benefits from adopting this CP, and although compliance with LD 231 through CP is not compulsory, this practice is widespread among Italian-listed and other large companies (Allegrini and D'Onza, 2003; Arena and Azzone, 2007; Corbella, 2013; Rossignoli, 2013; PwC, 2017). When twice charged with corporate crimes according to LD 231, Pharma 101 successfully demonstrated that the employees' conduct was inspired not by the company but by the private interests of the individuals in question. Therefore, its CP operated as a defence against corporate liability penalties.

Second, Pharma 101 operates in a regulated pharmaceutical industry, with peculiarities in terms of the nature of the products, the stakeholders involved and the multiple economic and social interests associated with its products (Dukes, 2002). The bribery of public officers (doctors) is one of the most representative examples of corporate crime conducted by pharmaceutical companies. Specifically, pharmaceutical representatives could potentially bribe healthcare professionals during their informative duties aimed to promote the company's drugs and compel them to prescribe the company's drug to patients instead of an alternative. In the Italian pharmaceutical industry, Farmindustria – Italy's association of pharmaceutical companies and a member of the Italian industrial federation – prepares and updates detailed guidelines that illustrate what a CP should consist of in considering the industry's peculiarity. This is characterised by the unique nature of its products, participants and varied economic and social interests. Pharma 101 has followed these guidelines in designing and implementing its CP.

Third, Pharma 101's CP adherence was bolstered by the ethical stance of its parent company; its mission statement proclaims an utmost respect for humans, health and ethics. This parent company is a global-listed healthcare firm that operates in several countries and controls one of the world's largest pharmaceutical groups. Pharma 101 must adhere to its parent company's ethical and compliance policies.

4.2 Data collection

To achieve an understanding of CP implementation as a practice, we based our analysis on interviews with individuals who are not only engaged in the CP's daily functioning within the company at different organisational levels but also belong to different departments, for example, such business departments (as sales, marketing, meeting services) and such staff departments (as compliance and legal ones).

The interview process spanned two years and included 21 interviews. Similar to prior research investigating the evolution of practices with a practice lens approach (Shove and Southerton, 2000; Shove and Pantzar, 2005), the interviews occurred after the practices had already begun. The interview process was developed in two phases as follows: the first phase began in March 2015 and finished in September 2015 and comprised 16 interviews. The second phase began in November 2016 and ended in February 2017, and it comprised five interviews [6].

Each interview was recorded with permission and lasted 45 min on average. At least two of the three authors participated in each interview by submitting questions and taking notes, which were used in addition to the interview transcripts. Each interview began with an enquiry related to the interviewee's background; the researchers also explained the project's general objective (i.e. to draft a paper with empirical evidence of processes related to CP implementation as associated with LD 231/01). Each interviewee was individually contacted and interviewed after obtaining his/her office phone number and business e-mail from Pharma 101's organisational directory, which is also a fundamental element of the CP. Interviewees' anonymity was guaranteed as their identities remained classified and none of their information was shared with anyone else in the company. These individual interviews also deterred any reciprocal influences among respondents.

The first interviews included the compliance officer as well as members of the supervisory body with primary competencies centred on policies and procedures, business compliance, risk management and internal auditing. These interviews provided the authors with some familiarity as to the governance structure. With this “formal” CP functioning and governance structures in mind, the authors conducted further interviews. As the analysis focused on the practical implementation of CP throughout the company, several interviews included managers and employees working for the company's business departments. In their capacity as a business division's chiefs or employees, they must accomplish core business tasks while avoiding misconduct and engaging in the (self-) controls established in the CP. The staff department interviews included members of the compliance and legal offices; two supervisory body members also provided insights. Across this broad sampling, these interviews included employees who experienced all phases of the CP implementation, as well as some who began their employment with Pharma 101 more recently; we interviewed employees with a minimum five years' seniority at the time of the interview. None of the interviews included employees who worked for the company previously but left before the data collection period although such a sample would only include six people who resigned after the CP's implementation. Table 1 summarises the interviewees' details, and Table 2 outlines the main issues covered during the interviews. The identifying code of the interviewees in Table 1 is based on the department's area (staff or business) and their position (manager, employee, etc.).

4.3 Data analysis

An interpretative stance guided by Schatzki's practice theory was adopted in analysing the collected data and developing a theoretically informed narrative (Auerbach and Silverstein, 2003). Codes were generated according to the theoretical framework and discussed among the authors (Strauss and Corbin, 1990; Auerbach and Silverstein, 2003). Specifically, CP implementation has been investigated in terms of the daily activities enacted by practitioners and the practice-organising principles Schatzki (2002) depicted the following: (1) the knowledge of how to act relative to the CP (practical understanding); (2) the rules activated to regulate the CP's adoption and to which practitioners adhere, such as laws regarding corporate crimes and “Model 231”, the industry's CP guidelines and corporate codes of conduct; (3) the intentions, beliefs, desires, hopes and expectations associated with the CP (teleoaffective structures); (4) the attitude with which the CP is implemented (general understanding). Other codes relate to the people involved in implementing the CP and to the artefacts that materialise during the CP's implementation process, such as internal controls and risk management systems, training courses, internal reports and reviews of internal controls, the CP reports produced by consultancy firms and other formal or informal communications among the various actors involved in CP implementation. Additional codes were also generated during the analysis to facilitate a better understanding of practice variations, such as time and change.

All the interviews were simultaneously transcribed and analysed by two authors, with a careful focus on how the actors described and interpreted their activities to execute the CP (Orlikowski, 2002). To detect possible divergent perceptions of employees hired at different times, the authors carefully reviewed the interview transcripts in light of the hiring time. Such review allowed confirming that there were no notable dissimilarities in the personal perceptions of employees who were hired at different times, rather, their perceptions of the investigated topics, as specifically derived in this study, were consistent regardless of their duration with the company.

Specifically, interviewees shared the same views about the CP implementation phases. These three phases, that are presented separately in three sub-sections within the following Section 5, were first identified according to the interviewees' perceptions of their activities. The analysis of the interviews informed by the Schatzki's practice theory allowed us to confirm this timeframe because we noticed significant differences in how the practice properties manifested across these phases.

This study complements the interview analysis by relying on documents related to the CP, whether public or private. These documents supported efforts to verify the interviewees' memories about old facts and represented various artefacts related to the CP implementation process, including: lists of offences, lists of compliance risks, crime prevention procedures, disciplinary penalties (withholding on salary, formal reprimands, demotions, dismissal), the supervisory body's composition and performance, the corporate processes involved in internal control systems for LD 231, training programs, program compliance assessments and the functional management of information flows.

5. Findings

This section provides a theoretically informed narrative of the implementation of the LD 231–related CP within the case study company. It particularly highlights how CP implementation has evolved since the time of its introduction until the more recent interviews relative to changes in the practice-organising principles Schatzki (2002, 2010) observed: practical and general understandings, rules and the teleoaffective structure. The section is separated into three sub-sections according to the three phases of the CP implementation that emerged from this analysis.

5.1 Phase 1: the CP practice as abiding by restrictions

In July 2005, Pharma 101's board of directors decided to introduce a CP associated with LD 231 with the aim to ensure the company's compliance with the new law and emerging best practices. Although a CP was not required by law, the board of directors decided to adopt it four years after the related legislative decree was released. As the compliance officer (SM1) and the compliance officer's assistant (SE1) both noted, most of Pharma 101's competitors began to address this regulation, and Pharma 101 subsequently intended to do the same.

The CP included a code of conduct, several procedures for handling business activities, controls over business activities and penalties for violations. As required by LD 231, the board of directors appointed a supervisory body, in which Pharma 101 comprised the following: a legal officer, human resources officer, the CFO and the CEO. Initial actions involved an internal audit by finance and legal managers with the support of an external lawyer, which included: (1) associating the extant business procedures, which describe how to address business activities, with specific controls; (2) matching these controls with penalties for violations and (3) coordinating these controls with the principles in the extant code of conduct.

The board of directors later created the compliance department as a separate and autonomous department that directly reports to the former. A compliance officer with a background in finance and audit management was appointed and remains in charge. Furthermore, a new legal officer with a corporate legal background was hired. Following the board of directors' requests, the compliance department first identified the additional crimes with which the company can be charged according to LD 231. It also proposed that the board of directors adopt additional controls and augmented the existing controls with some specific monitoring mechanisms to prevent misconduct. The compliance staff formalised these rules by performing a self-assessment devoted to identify and describe the following: (1) the double signature mechanisms, (2) the segregation of responsibilities and (3) the suppliers' selections. Moreover, specific tests were periodically conducted to verify the compliance with these additional controls. Each test's results were discussed with the board of directors, which used such periodic information inflows to observe the alignment between rules and behaviours.

While the compliance staff periodically conducted these tests, personnel within the business departments limited their efforts to respect the new rules' explicit limitations. Specifically, people read the procedures as they were written in the CP to identify the limits on the actions they intended to execute. Subsequently, employees constrained their actions according to what was allowed in the CP's procedures. For example, an additional restriction on marketing activities limited the samples that a pharmaceutical representative could provide to doctors, as minimising this quantity could avoid their improper use. As the “proper” number had to be identified according to the spirit of the CP – which encouraged the avoiding of “freebies” or other means to “win the doctors over” – the rules also provided a maximum number of samples for each doctor. Thus, pharmaceutical representatives chose to provide exactly the maximum amount of samples indicated in the rule rather than identifying the proper number of samples for each doctor.

The business department managers' and employees' practical understanding of the CP practice was limited to respect what was explicitly indicated in the individual rule. The CP practice from their perspective consisted of the following: (1) carefully reading the CP procedures to identify the actions to perform or avoid and (2) constraining their daily activities to what was clearly established in the CP procedures. This practical understanding manifested as a respect of CP restrictions that were explicitly stated in the rules that were subject to specific controls, instead of attempting to independently interpret these restrictions:

At that time, I did not realise the big picture. I mean, I was told about the new constraints and I only cared to understand what I should do, and be careful to respect it. In other words, my efforts were devoted to ensure I was slavishly adhering to the limits (BE4, a pharmaceutical representative).

Some employees within the company's staff departments were unaware of how to handle the CP's initial adoption as the board of directors only provided a limited effort in communicating the CP's adoption throughout the organisation. The only artefact in place in this phase consisted of newsletters devoted to notifying employees of the new limits and restrictions. The board of directors then charged the compliance department with the first implementation activities, but those working within the compliance department had a shallow, limited understanding of the CP due to the novelty of the legislation and its underlying principles:

The first time I heard about the CP was during a cyclical meeting […] compliance staff told us that the company had adopted the CP according to a certain Italian law, but at that time I had no idea of what it was, or what I had to do to deal with it (BE3, a pharmaceutical representative).

Well […] at first we met in our meeting room, and it was kind of funny because we felt like we were groping in the dark. None of us had a clear idea…I mean…nobody had an idea of what a CP was, and especially me (SM2, a legal officer).

A general understanding of the confusion surrounding the overarching CP system transpired through daily activities. While the teleoaffective structure involves the willingness to commit to the new law and emerging best practices, neither business managers nor employees understood why the company chose to introduce the CP as they deemed Pharma 101 already compliant with the stringent procedures enforced according to the parent company’s compliance system. The new CP was activated only to comply with the law and emerging best practices:

At that time I thought that we were missing the umpteenth rule (ironically)…about samples…It impacts not only the pharmaceutical representatives, but we even have a system linking the number of allowed samples with production to say how many samples they have to produce…and no more. […] I had the feeling that we were already acting in an ethical way, so it was not clear to me what more we had to do than what we had already been doing. […] The suppliers’ selection process was already strictly regulated…instead, with the CP, we have been required to differentiate our actions between “preferred” and “non-preferred” suppliers: I usually had to check to make this distinction, because I did not realise the reasoning behind this (BM1, a sales manager).

At the beginning I was very confused; I did not know these rules existed and that I had to comply with them, so I felt burdened. It was frustrating (BE4, a pharmaceutical representative).

To summarise, the practice during the CP implementation's first phase only consisted of abiding by the restrictions explicitly established by the CP's new rules, such as procedures and controls. The CP practice reflected not only a practical understanding, limited to what was explicitly indicated in the rules but also a general understanding of the confusion regarding its overarching system. The teleoaffective structure aimed for alignment with the law, with emerging best practices only permeating the compliance staff's perspective, while the business staff did not share any particular belief in the practice. Newsletters devoted to advising on the newly introduced restrictions were the only artefact, and they were found to have a superficial impact on people's perspectives.

5.2 Phase 2: CP practice as executing compliance staff's advice

The second phase began around early 2009 and ended in late 2012, and it included business managers' and employees' direct involvement in updating the CP. External business consultants – charged with collaborating with the compliance staff to update the CP with the board of directors' approval – interviewed the business staff to map each business process and suggest to the company's management the various controls to add.

Daily activities evolved, in the sense that business departments began to interact among themselves and with the compliance staff to choose the actions to be executed. Specifically, dialogues increased among people across different business departments in an effort to brainstorm and share common experiences. Most of the business department interviewees identified such interactions among offices as “habitual”. All interviewees employed by Pharma 101 at that time recalled their efforts to address the CP.

Managers were constantly in contact with the compliance officer through e-mails, by telephone and in person to gather reassurance of what instructions to convey to the employees in conducting individual activities. They even consulted the compliance department regarding ordinary tasks and to confirm that they had comprehensively understood the meaning of the CP and that their activities were compliant with the CP's rules. For example, the conference manager scheduled a meeting with the compliance officer before organising a conference to verify that its preliminary concept was compliant with the CP. After sharing its basic characteristics with the compliance officer – such as the conference's purpose, speakers, participants, duration, sponsors and the option of setting a fee – the manager progressed with the activity by asking the compliance officer for reassurance about the activity’s CP compliance as further details manifested during the process.

Similarly, the compliance department mandated that pharmaceutical representatives complete a specific form to report details of every meeting with doctors, such as the technical information given, the samples provided and clarifications required. This reporting aimed to provide an information inflow to control ordinary activities. However, instead of completing each report after each doctor's meeting, Pharma 101's representatives collected their doubts and waited until the end of the week to ask the compliance staff for suggestions regarding how to complete their weekly reports. Subsequently, the compliance officer's assistant (SE1) became accustomed to seeing business department employees queuing at their doors. Only after obtaining validation regarding such compliance could they conduct their activity. If the compliance department did not validate their proposed method, the employees instead requested specific instructions for the contingent situation and then executed what the compliance department indicated they should do.

The actions conducted by business managers and employees manifested in a practical understanding, which consisted of executing the compliance staff's instructions according to the CP. While the business staff could identify the problems associated with the CP, they continuously enquired regarding the proper actions to comply with the CP and asked for reassurance before performing activities that could potentially generate misconduct. People working in Pharma 101's business departments still did not understand the need for the usefulness of additional controls and suffered for the CP's unquestionable limitations to their daily activities. The consideration with which business department managers asked for the compliance officer's opinions before any decision also conveyed their fear of failing to identify the correct action:

I was always uncertain of what I had to do, so I continuously looked for suggestions from compliance (SM2, a conference manager).

They were afraid to be wrong, so they preferred asking to ensure they were compliant in what they were doing (SE1, the compliance officer’s assistant).

Thus, the fear of penalty was the attitude under which the practice was performed (the general understanding). This attitude was particularly derived from the introduction or reinforcement of rules: (1) the “compliance correction” in the remuneration system and (2) the internal disciplinary system.

First, a “compliance correction” was introduced in the managers' and employees' remuneration system. Dedicated compliance performance indicators were introduced to rectify the performance evaluation, such that employees who perform well in terms of compliance score additional points. The employees with a minimum compliance correction score obtained a percentage of increase in their base salary, while managers and employees who performed poorly experienced withholdings from salary. Consequently, the compliance correction in both cases impacts employees' performance evaluations, and thus, their salaries:

I realised I was not even free to treat doctors to a cup of coffee. If I failed, I would be penalised for that. So I tried to do my best to stand out in my performance evaluation (BE5, a pharmaceutical representative).

Second, the board of directors followed the compliance officer's suggestion and reinforced the internal disciplinary system by adding more specific penalties associated with CP violations. Some employees who had failed to execute CP practices received penalties according to this internal disciplinary system. The compliance officer (SM1) recalled that on average, the company would exhibit “soft” measures if a manager or employee performed poorly, such as moving him or her to a different business unit or another office. Furthermore, no one was ever dismissed for any business improprieties other than compliance violations; the disciplinary system includes severe measures for any non-compliance; for example, two business department employees were asked to step down.

The CEO and compliance officer both recognised the need for people to understand how to execute the CP and its overarching system.

I think that just telling them what the CP is according to the law and rules would never have led anywhere. They needed to build their awareness of what they have to do in practice. To this end, we usually show them examples of situations they would have to cope with by explaining what they would be asked to do according to the CP, and what, on the other hand, would be considered wrong (SM1, a compliance officer).

Moreover, the compliance department established a dedicated artefact as follows: an online course providing detailed information about the law inspiring the CP, how extant procedures have changed, the additional control introduced and several examples of incorrect behaviour taken from the press. The CEO mandated that every employee take this online course.

Nevertheless, employees were still uncertain in autonomously identifying how to choose to execute one action instead of another to comply with the CP. Thus, another artefact was established as follows: a comprehensive training program relying on interactive sections, practical examples and self-assessments. Training increased in quantity and frequency as several sections devoted specifically to the CP were added to those regularly organised in the company. Such training sections were delivered during periodic meetings to provide more concrete, real-life examples; these allowed personnel to visualise and realise the CP's role in preventing misconduct and protecting both the company and employees from undesired consequences.

The enacted artefacts intended to avoid misconduct and exhibit an overall concern for avoiding any wrongdoing or teleoaffective structures. Specifically, these structures are derived from the impulse of the new CEO who was really concerned with misconduct and supported the introduction of dedicated rules and artefacts. The compliance officer (SM1) observed that the CEO was particularly sensitive to the CP because he/she was affected by a lawsuit, and he/she had to personally cope with compliance problems in the company where he/she previously worked. While that company won its case, he/she is fully aware that its compliance made a difference. The CEO made considerable efforts to increase employees' awareness of the risks of crimes. He/she directly engaged with several communication initiatives towards employees. For instance, he/she regularly sent e-mails and alerts about the relevance of proper behaviour within the pharmaceutical sector and examples of corporate crimes taken from the media (e.g. newspapers and podcasts). Business managers and employees were overwhelmed by these “tone at the top” initiatives, and they started believing that CP was not an issue only to be addressed by the company's top management. This resulted in concerns of the CP's concrete impact on anticipated behaviours every time they had to set up even ordinary activities:

I remember I was bombarded by the new CEO's e-mails. At the beginning I was almost ignoring them, but when I saw that the alarm was so persistent, I started worrying about the CP. I then began reading them carefully, and gradually I realised that the CEO really cared about CP and there were reasons for that (BE5, a pharmaceutical representative).

In summary, the CP practice during the second CP implementation phase consisted of following the compliance staff's advice regarding the “proper” actions to be executed. Facilitated by the previously mentioned artefacts—such as the web course, training program and CEO's communication initiatives—a practical understanding emerged in terms of executing the compliance staff's instructions, while the general understanding involved the fear of penalties according to the rules that have were introduced or reinforced in this phase (the “compliance correction” in the remuneration and internal disciplinary systems). Those focused on avoiding incorrect actions found that additional rules did not facilitate constructive engagement with the practice. Further, this attitude toward the practice coherently developed with a teleoaffective structure based on concern for potential incorrect actions and a desired aim of avoiding misconduct.

5.3 Phase 3: CP practice as self-assessment of legality

The third phase began in early 2013 and continued to the interview period; the practice in this phase consisted of autonomously choosing daily activities with a concern for the legality of such activities. Most managers and employees knew what actions were appropriate without reading the procedures because they could recall them in detail. The practice includes asking for the compliance officer's opinion, but this was seldom the case for unexplored projects:

People [working in business departments] are now autonomous. They are engaged in the controls and can help us. Many people walk up to us during their coffee break to discuss specific cases, but they usually have already a clear idea about the crucial points and just want us to reassure them that they are on the right track (SE1, the compliance officer's assistant).

I am used to knocking on Compliance's door to ask for details any time I am going to engage in a new initiative, [or] any time I have new incoming doubts. Further, I informally talk to my colleagues in other departments to see what compliance was suggested for their situations and how they are behaving with reference to the CP (BM3, marketing manager of the oncology business unit).

The CP practice became completely embedded in daily activities as people respected the rules as fact. For example, the conference manager independently established the general conference by avoiding extravagant locations because he/she recognised that would be intended as a benefit offered to the participant doctors. This autonomy in decision-making reveals an awareness of the actions to execute. Moreover, the compliance officer (SM1) noted that they aimed to improve managers' and employees' understanding of the reasons why such controls exist and the intangible benefits derived from working for an unblemished company. The compliance officer and supervisory body members recognised that these efforts were ultimately successful:

Most already knew how to act, and therefore, the company had to add fewer controls. The real effort involved making people aware of what compliance meant beyond each single rule (SEE1, a member of the supervisory body).

The CP practice prompted people to autonomously ensure that any future actions did not hide any attempt of bribery; this conveyed a practical understanding, which consisted of critically (self-)questioning each action's fairness from a legal and ethical point of view. Specifically, personnel could autonomously ensure that promotions, informative actions and various business projects avoided bribery towards doctors or other customers before these actions were executed:

Now when I have to make a decision… even basic, in daily activity (I mean CP is a matter of everything anybody does while working) […] I think about the rules to see if that action is allowed, [and] if so, I ask myself if it is proper according to the legal and ethical point of view. Basically, I can say that before acting I think about what I am doing, but mostly I know that I am on the right way, because it is now almost natural (BE4, a pharmaceutical representative).

I used to pay attention to understanding what I had to do to stick to the procedures and to be unaffected after the controls. Now I am aware I am a part of the whole system of corporate responsibility, and I realise that I have to go beyond the single rule to behave in a proper way (BE3, a pharmaceutical representative).

We're linked to a precise code that allows us to stand out. Doctors know that we adhere to a strict work ethic, and therefore consider us a reliable resource. It is not only an honour for me to be working in a company that is seen as a benchmark in the industry, but it also gives credibility to my position and facilitates my work (BE4, a pharmaceutical representative).

This practical understanding is facilitated by introducing an additional artefact – an IT platform that plainly displayed the rules, explanations, examples of activities and compliance performance indicators. Such a platform was established to facilitate employees' awareness of the logic behind each rule and control. Moreover, managers sometimes review the procedures available in the IT platform to ensure that the CP's requirements will be fulfiled as they carry out their activities:

We have put in a lot of effort to help people understand that we have created an intranet platform where people can retrieve key points containing updates, executive summaries about the controls and a series of key performance indicators about compliance. Whenever somebody has a doubt, looking at the platform will provide advice, suggestions and examples. Of course, the compliance team is always available to help, but this platform helped people to understand (SE1, the compliance officer's assistant).

Supported by the board of directors and CEO, the compliance department continued to deliver periodic training sections and enriched them with discussions of the two prior lawsuits involving Pharma 101. Although the company successfully defended itself by demonstrating its proper conduct, these events allowed Pharma 101 to clarify the usefulness of its rules and procedures and provide concrete examples of proper and improper behaviours, as well as how to distinguish them. These training sessions prompted participants to realise not only the severity of the eventual consequences of misconduct but also the CP's usefulness in preventing them. Business managers and employees began to perceive the CP as a benefit to increase their confidence about identifying the “proper” action towards compliance. The interviewees' comments revealed that they felt confident in identifying, choosing and implementing actions to safeguard themselves and the company relative to the liabilities arising from LD 231. For example, the marketing manager of the oncology business unit (BM3) recognised that she and her colleagues had changed their mindset, which reflects their understanding of the added value for themselves as well as the company:

[Now] I feel confident that respecting the CP I am acting for the best. This makes me feel safe, as a worker, as a woman, as a wife and as a mum (BM3, marketing manager of the oncology business unit).

After observing a concrete example about the risk of lawsuits after misconduct, Pharma 101's personnel began to recognise the CP was paramount in preventing regrettable consequences. Moreover, managers and employees also realised the CP's usefulness for the company as well as their own credibility, such that their jobs became safer. They understood the CP not only in terms of avoiding misconduct but also as a responsibility to do their utmost to behave legally. The general understanding of the CP practice is reflected in legal-minded behaviour in conjunction with the new teleoaffective structure instilled by the CEO, supervisory board and compliance staff. The latter entities realised that all CP-related activities must focus on promoting fair behaviour, and the organised training initiatives particularly aimed at increasing people's attitudes towards fair behaviour. Consequently, business managers and employees actively participated in the training activities organised by the compliance staff in collaboration with business departments. The compliance officer's assistant (SE1) noted that no one would miss those meetings because a common curiosity and interest exists regarding the topics pertaining the CP: (1) before the meeting, by preparing questions about new projects to ask the compliance officer; (2) during the meeting, by taking notes and memos during the presentation and (3) after the meeting, by discovering links between what the compliance officer said and the employee's own activities.

In summary, the practice during the third CP implementation phase consisted of employees' autonomous self-assessment of their daily activities relative to their legality. Critically (self-)questioning each action's fairness displayed their practical understanding of the CP practice at this stage, while the general understanding evolved towards safeguarding each action's corporate legality. This attitude is combined with a teleoaffective structure of fair behaviour, reflected as the intended aim and commitment towards fairness as an anticipated behaviour. The IT platform and periodic training sections are artefacts that facilitate further changes in the employees' practical and general understanding of the CP. This is coherently combined with the new teleoaffective structure that allows the previously mentioned artefacts to diffuse among all business managers and employees.

6. Discussion

This section provides a discussion of the findings in the light of the theoretical framework and points out the major contributions to the literature.

6.1 The mutual constitution of practical and general understandings

Prior CG research has elucidated the practice lens approach's potential,l and Schatzki's account in particular, in capturing the actual functions of CG (Ahrens et al., 2010, 2011; Ahrens and Khalifa, 2013; Brennan and Kirwan, 2015). Furthermore, Ahrens et al. (2010, 2011) argued that CG functioning strongly relies on practical understanding as “complexes of know-how [that] go beyond the individual's abilities to deal with aspects of corporate governance” (Ahrens et al., 2011, pp. 319-320). The present research has drawn on this intuition to provide theoretically informed case insights.

The empirical analysis confirms the argument developed by Ahrens et al. (2010, 2011) by demonstrating that CP implementation strongly relies on practitioners' understanding of what to do to execute this CG mechanism. The research also offers an evolutionary perspective on the practical understanding by revealing how such understanding evolves over time. While the practical understanding was initially limited to executing what was explicitly indicated in the CP's rules, it has evolved to include executing the instructions gathered by company's CP experts – in this case, Pharma 101's compliance staff. This ultimately manifests as an autonomous self-assessment of the fairness of each action. Schatzki (2001, 2002) claimed that practical understandings alone rarely determine actions related to the practices that entail multiple actions, projects and emotions (Schatzki labels them as 'integrative practices'). Our findings confirm this theoretical argument for CP practices, which necessitate further practice-organising principles. However, the practical understanding emerges as a fundamental aspect of CP functioning as it was observed that practitioners without such an understanding of the actions to be executed will continuously check for instructions.

We interpret this finding given the fact that practitioners – and particularly those engaged in business activities – may not possess any particular expertise on CG issues and need time to understand what a CG practice entails in terms of their responsibilities and related actions to be executed. When they ultimately realise the practice's requirements relative to their daily tasks, they will become confident and more prone to engage with the practice. The finding confirms the argument by Ahrens et al. (2011, p. 320), as follows:

[p]ractical understandings cannot […] arise from principles or rules in isolation, nor can they be imposed by regulators. In any particular practice the knowledge of how to do something well only emerges over time through sustained work shared across people.

Indeed, practical understanding is a property of “particular practices” and not “a sort of general know-how lying behind most or all of human behaviour that exhibits sensitivity to context” (Welch and Warde, 2017, p. 187, emphasis in the original).

The research also indicates that practitioners' general understanding is particularly important in organising CP activities. When practitioners enact the CP with confusion about its overarching system, the CP's implementation was incredibly formal and manifested as merely a respect for the restrictions explicitly established by the CP's rules. When general understanding evolved towards a fear of penalties, practitioners continuously asked for the compliance staff's advice. Finally, when the attitude towards the CP advanced to become a willingness to safeguard corporate legality, such practitioner attitudes manifested as a self-assessment of their activities relative to their legality. Therefore, the paper expands prior CG research based on Schatzki's work by detailing the role of general understanding, a practice-organising principle that Ahrens et al. (2010 and 2011) neglected [7].

Our attempt to elucidate how general understanding influenced action also revealed reciprocal influences between practical and general understandings. On the one hand, the general understanding influences practitioners' comprehension of how to execute the CP in their daily actions. For instance, confusion in the first phase regarding the CP's overarching system compelled business staff to only do what the rules explicitly indicated. During the second phase, the fear of penalties resulted in executing only what was suggested by the compliance staff. On the other hand, the progressive understanding of how to implement the CP is important in supporting a “broader” understanding of the CP and its usefulness for both the company and its employees. For example, business employees in the third phase became autonomous in choosing the “proper” actions to execute; this helped them approach their CP responsibilities with constructive attitudes. This finding solicits a further conceptual and practical exploration of the reciprocal influences between practical and general understandings, which parallels the call to further engage with these concepts and related connections (Caldwell, 2012; Welch and Warde, 2017).

Prior research has interacted with the concept of general understanding in the context of accounting and risk management practices (Jørgensen and Messner, 2010; Nama and Lowe, 2014; Bui et al., 2019). Furthermore, Nama and Lowe (2014) have outlined the “mutually constitutive nature” of both general understanding and teleoaffective structures in the context of private equity practices. They particularly demonstrated a close connection between the attitude with which a practice is performed and the practices' affectivity. Bui et al. (2019) further explored this relationship in the context of risk management practices to reveal that general understanding is also strictly connected to the practice's teleological dimension. Our findings confirm these theoretical advancements by indicating that the general understanding coherently evolves with both the teleological and affective dimensions of a practice. Moreover, most practitioners' confusion during the first phase about the CP's overarching system reflects their assigned aim of (merely) adhering to the law and best practices. Furthermore, the fear of penalties during the second phase manifested as an intended aim and behaviour towards avoiding misconduct and a concern with incorrect actions. Finally, their attitude during the third phase revealed a willingness to safeguard corporate legality, which matches the assigned aim and anticipated attitude of fair behaviour and commitment towards fairness.

6.2 The practitioners' immersion in the practice

Previous studies argued that “without a top management commitment to ethics, a company's ethics practices may be the kind that employees can easily ignore […] executive commitment is essential” (Weaver et al., 1999a, b, p. 550). The current analysis confirms this argument, and our findings indicate that weak engagement by governance bodies and compliance staff with the CP's affective structure undermines the possibility to align the business staff's mindset with the practice's intended aims. Further, the CEO's sensitivity to compliance and business ethics favours the CP's enhancement. Employees' actual engagement with the CP requires not only top management's commitment but also a means to align practical and general understandings with the CP's requirements to overcome the barriers to behavioural changes that CP often face when inappropriate incentives or penalties are encountered (Weaver, 2014).

Therefore, the findings extend prior CP studies focussed on individuals' motivations, perceptions and incentives (Kaptein, 2011a, b; Singh, 2011) by demonstrating how practitioners' attitudes vary as result of their immersion in daily practice-related activities. Thus, the “effectiveness” (Kaptein, 2011a; Singh, 2011) of corporate codes of conduct cannot be ascribed to single variables but should be interpreted as an outcome of the interactions among practitioners. Furthermore, the findings demonstrate that changes in the rules affect the multiple activities and controls employees perform at different levels. However, how employees actually executed the CP depended more strongly on their overall and practical understanding of CP. The introduction of new rules represented only a first step towards affecting employees' mindset, as clearly highlighted in the insights from the case study's first phase. Without a comprehensive understanding of the responsibilities associated with the CP, it would have been difficult to widely implement this mechanism.

6.3 The role of artefacts in moulding practices

Schatzki (2001, 2005) asserts that people mobilise artefacts in their efforts to implement practices. Furthermore, Ahrens et al. (2010, p. 6) posit that CG practices “stretch over diverse arrangements of people, artefacts, organisms and things”. Artefacts in our research were fundamental in fostering practitioners' “immersion” in the CP practice. Various types of artifacts – such as internal control systems, training courses, performance indicators and formal and informal means of communication – emerged as particularly useful for encouraging interactions among different members involved in executing the CP. These artefacts fostered a widespread understanding of what comprised the CP in terms of daily activities and the responsibilities arising from its adoption. In our case study, adopting an IT platform in the third phase forged a practical understanding by facilitating practitioners' line of reasoning in their daily execution of the CP. By providing plain explanations of rules and examples of activities, this artefact acted as a reference point to ensure that practitioners' actions complied with the CP's requirements.

Artefacts also facilitated changes in general understanding; specifically, practitioners' fear of withhold on salary, and other disciplinary penalties were enhanced by corrections towards compliance behaviour within the remuneration system as well as the internal disciplinary system. Furthermore, practitioners changed their attitudes towards the CP after training activities focused on explaining the relevance of “proper” CP in the case of lawsuits; consequently, they understood the CP's usefulness for the company as well as themselves. In summary, the analysis demonstrates how CP-related artefacts moulded practical and general understandings and favour the latter to align with teleoaffective structures. This enriches prior studies that have marginally engaged with artefacts (Ahrens et al., 2011). We believe that the exploration of how CG artefacts are conceived of and used by practitioners at different organizational levels may offer further insights on CG daily functioning. While prior studies (Kaptein, 2011a, b; Schwartz, 2004) have highlighted that training activities influence practitioners' perceptions of the CP, the present research reveals that this perception has evolved as employees have engaged with related artefacts.

7. Conclusion

This article investigated how firm practitioners implement CPs, or specifically, how they conceive of and execute their CP responsibilities. Our case study analysis involved a practice lens approach as well as an interpretation of interviews and documentary materials collected from an Italian company with prolonged compliance behaviours. Our interpretation of CP was also influenced by Schatzki's practice organisation framework, which denotes CP as a practice organised by rules, practical and general understandings and teleoaffective structures. The analysis highlights the evolution in the CP practice. A practical understanding of daily actions required to accomplish the CP and a general understanding of the responsibilities connected with the CP, such as the attitudes with which the CP is performed, are mutually constitutive and jointly favour this evolution. Both of these types of understanding are facilitated by the use of specific artefacts. These artefacts also allow aligning practitioners' general understanding with the CP's assigned objectives and the desired reactions to them (teleoaffective structure).

The article offers several contributions. First, this research confirms the appeal of using practice theory – Schatzki's account in particular – to explore governance issues; it enriches our understanding of CG practices by providing theoretically informed case study insights on implementing this CG mechanism. Indeed, to the best of our knowledge, this is the first study to experiment with Schatzki's practice lens approach within an empirical setting involving CG practices. While prior studies have underlined practical understanding's significance in moulding CG activities, the present study empirically confirms the argument. Our work also extends this argument by highlighting the reciprocal influences between practical and general understandings, as well as how artefacts mould these understandings and spread specific teleoaffective structures among practitioners. We elucidate the close connections between practical and general understandings to theoretically advance Schatzki's practice organisation framework. This also supplements previous studies that have illuminated the “opaque” concept of general understanding (Caldwell, 2012), particularly in the context of accounting and risk management practices (Nama and Lowe, 2014; Bui et al., 2019).

Future research may attempt to speculate as to how practitioners differently organise various firm practices – such as those related to accounting, risk management or CG – within the same organisational context. Generally, this research offers a foundation to further experiment with Schatzki's account, both within and across accounting, risk management and CG practices. Furthermore, the analysis offers a complimentary perspective on CP, an interdisciplinary topic that is increasingly investigated according to various approaches, whether objectivist, interpretative or social-constructionist (Parker and Nielsen, 2011). Therefore, we contribute the to the interpretivist task of “describing and understanding a whole range or organisational perceptions of and behavioural responses to regulation”, rather than “mapping “compliance” and “noncompliance” in terms of levels of compliance (as objects of objectivist research)” (Parker and Nielson, 2011, p. 7). This study also establishes some practical implications in line with practitioners' calls for more attention to the accountability side of CP (Volkov, 2015; Jones, 2017). By highlighting the empirical insights about practitioners' understandings of the responsibilities the CP establishes, this work calls on governance bodies and staff departments to substantially consider both practical and general understandings while forging the CP's regime of accountability. These understandings are fundamental to prompt constructive engagement with the CP at different organisational levels. Rules and disciplinary penalties are not enough in order to pursue the practitioners' engagement with the CP implementation. Whilst constituting the ground of CP enactment, rules and disciplinary penalties alone may even hinder constructive engagement with this CG mechanism.

This study also has limitations. First, its conclusions could be biased by its unique, specific research context. As the case company is a subsidiary of a global healthcare company, compliance was highly relevant even before the adoption of the CP associated with LD 231. The empirical analysis revealed the impact of this CP's adoption on employees' perceptions and actions; however, it is not possible to conclusively state whether these perceptions and actions would have emerged in the absence of the pre-existing compliance culture. Its heavily regulated industry also encouraged Pharma 101 to adopt the CP, as this industry defined organisational members' behaviour. Thus, it is difficult to predict how the company would have behaved in the absence of specific industry regulations. Further research projects might investigate companies with no previous experience with corporate codes of conduct.

The interview process occurred at a time when organisational members had experienced several years of CP adoption, such that their perceptions of more remote times would be less clear than those of more recent events. Furthermore, more recent changes may have influenced perceptions of their preliminary experiences with the CP. The research design sought to minimise the effects of this potential bias, but additional research might pursue ways to gather organisational members' perceptions at the moment they arise. However, while this instantaneous data collection may avoid memory biases, it may result in working on raw and preliminary perceptions. Researchers could also address the role of practitioners who operate beyond organisational boundaries, such as regulatory agencies or shareholder associations (Ahrens et al., 2011). Generally, the approach inspired by the 'practice turn' in social sciences may not only help to address these limitations but also derive additional stimuli.

Table 1

Interviewees

Role	Department	Department's area	Position	Background	Number of interviews	Coding
Compliance officer	Compliance office	Staff	Manager	Finance and audit	4	SM1
Legal officer	Legal office	Staff	Manager	Legal	1	SM2
Compliance officer's assistant	Compliance office	Staff	Employee	Compliance and legal	3	SE1
Compliance employee	Compliance office	Staff	Employee	Legal	1	SE2
External member of the supervisory body	Not applicable	Staff	External expert	Administration	2	SEE1
External member of the supervisory body	Not applicable	Staff	External expert	Administration	1	SEE2
CEO	Not applicable	Business	Executive	Administration	1	CEO
Sales manager	Sales	Business	Manager	Marketing and sales	1	BM1
Conferences manager	Meeting services	Business	Manager	Marketing and sales	1	BM2
Marketing manager of the oncology business unit	Oncology	Business	Manager	Medicine	1	BM3
Medical manager's assistant	Marketing	Business	Employee	Medicine	1	BE1
Business director's assistant	Marketing	Business	Employee	Administration	1	BE2
Pharmaceutical representative	Regional sales	Business	Employee	Medicine	1	BE3
Pharmaceutical representative	Regional sales	Business	Employee	Medicine	1	BE4
Pharmaceutical representative	Regional sales	Business	Employee	Medicine	1	BE5

Table 2

Key issues discussed during the interviews

Knowledge of the company's CP and the law that led to the CP's introduction

Knowledge and perceptions of the company's efforts to implement and adapt the CP over time

Offices/organisational members primarily involved in the CP's implementation

Rules and procedures introduced by the CP

Personal duties arising from the CP

Understanding of the responsibility derived from the CP's implementation

Understanding of the activities pertaining to the CP's implementation

Interactions and discussions with colleagues as a consequence of the CP

Personal perceptions and feelings about the CP and its requirements

Opinions of other organisational members' perceptions and feelings about the CP and its requirements

Awareness of compliance-related lawsuits against the company and their impacts on employees' behaviour

Artefacts (e.g. training activities, internal reports and reviews and e-mails) mobilised as a consequence of the CP

Notes

1. Corporate responsibility violations span the following categories: offences against public officials; information technology crimes and unlawful data processing; crimes committed by criminal organisations; breaches of public trust; crimes of obstruction of industry and trading activities; corporate crimes; offences concerned with terrorism or the subversion of the democratic order; crimes of female genital mutilation; offences against individuals; market abuse crimes; manslaughter or serious or critical injuries committed in violation of applicable workplace health and safety laws and regulations; receiving, laundering and using money, assets or profits of illicit origin; crimes involving copyright infringement; incitement to not testify or to bear false testimony to judicial authorities; environmental crimes; the employment of a foreign citizen with an invalid residence permit and transnational crimes.

2. We use the labels “staff department” and “business department” to distinguish organisational departments according to the staff and business areas of the company: the former area includes the departments that support the organisation with specialised advisory and support activities, while the latter area includes the departments that directly participate in the organisation's core work.

3. This account of practice organisation is based on Schatzki's (2002, 2010) more recent works, while his prior accounts (Schatzki, 1996, 2001) lacked a dimension discussing “general understanding”.

4. This type of CP, aimed to deter the crimes specified in LD 231, is the “organisational, management and controls model”.

5. According to the Italian LD 231, courts faced with evidence of misconduct will charge the company with “criminal liability” by scrutinising whether the CP was “properly” implemented to determine whether (and how): (1) management adopted and efficiently put into practice, prior to the offence, a CP in line with all legal requirements; (2) the task of monitoring CP implementation was entrusted to a (“supervisory”) body with independent decision-making and control powers and (3) any lack of organisational supervision over the individual who committed the offences has been reported.

6. Following the first-round review reports, we developed a second round of interviews to enrich our understanding of the CP implementation process throughout the company's hierarchy.

7. We interpret this omission in the light of their reference to Schatzki's (1996, 2001) practice organisation framework, which lacked the “general understanding” dimension; see also footnote 3.