I am concerned that [investment company] lacks an effective means of fixing problems. Last year, your management team tried to fix a legal compliance issue by taking things seriously and writing a memo. This didn't fix the problem, and the same legal compliance issue happened again. Your management team tried to fix this second legal compliance issue by taking things seriously and writing a memo, even though that failed to fix the problem last time they tried it. I fear that if your management team continues again and again to takes things seriously and write a memo, you will again and again fail to comply with your legal obligations. Therefore, I recommend that your management team try a different corrective action technique.
8D is a standard methodology for fixing a problem and making sure it stays fixed. It is not the only way to fix things, and it's a bit tedious at times, but it usually prevents you from messing up again in the same way. It's used by the automotive and aerospace industry (particularly to fix issues that affect safety or legal compliance), and by the US military. Here are the eight basic steps (taken from Wikipedia, with additional commentary by me):
D1: Determine who is going to fix the problem. This may be one person, or it may be a team of several people. You need someone with enough knowledge about the relevant business processes, and with enough authority and access to get the information they need to find out what happened. You also need someone on the team with enough authority to implement the solution. Most importantly, you need someone with enough time and other resources to work on the problem. In this case, having a VP involved is good, because people won't ignore him. However, he's probably very busy, so you may want to bring in someone else to help (maybe someone from Legal or HR).
D2: Define and describe the Problem. This is the hardest part - if you do it right, it's easy to implement a permanent fix. Specify the problem by identifying in quantifiable terms the who, what, where, when, why, how, and how many (5W2H) for the problem. So, you know you have multiple people in multiple offices in multiple provinces breaking provincial labour laws. But what's your exposure and liability? Have you just been breaking the law for a few months, or have you been breaking the law for years? Is it in offices in all provinces and territories with laws prohibiting unpaid interns, or just Ontario and BC? Do you have a few dozen former interns who could sue you and/or your advisers for unpaid wages, or a few thousand? Will the CRA be asking you and/or your advisers to remit a few thousand dollars of unpaid taxes, or will they go back and audit you for the past seven years, and levy penalties that have a discernible effect on your financials? Why were people doing this - were people hiring unpaid interns out of ignorance, and in isolated incidents, and only by independent advisers, or was this a deliberate, widespread conspiracy within your organization to break labour law and commit tax fraud (in which case, good luck hiding behind the corporate veil)? Is this just an issue with your financial advisers, or are other areas of your company also breaking the law?
D3: Containment. This is NOT just destroying evidence and deleting all the ads for illegal unpaid interns. Stop the bleeding, and fix the mess. Make sure that none of your offices are currently using unpaid interns, that any offices currently using unpaid interns immediately start paying them (and immediately pay for hours worked previously), and that none of your offices are advertising for unpaid interns. Identify all former illegally unpaid employees, and make them whole. Give the CRA the money that should have been remitted from the wages that should have been paid, and issue corrections to previous tax submissions and financial statements.
D4: Determine Root Causes. Note: problems NEVER happen because you have bad people. If you have bad people in your company, then your entire hiring process is flawed, and your entire company is likely full of malicious sociopaths. Presumably this is not the case. Therefore, you assume you have good people who did the best they could, but your internal processes failed them. Talk with the people who ran ads for illegal unpaid interns, and make it clear that you do NOT blame them at all for anything. Ask them why they did it, and how you can help them avoid it in the future. Perhaps they were following an old, out-of-date handbook that recommended this as a good money-saving practice. Perhaps they don't have a training handbook that identifies best practices. Perhaps they do have a training handbook, but it doesn't have a section on hiring policies. Perhaps the legal compliance department that vetts all your advertising material and business cards wasn't properly trained on labour law. Perhaps you do not have a policy stating that want ads must go through your normal advertising compliance vetting process. Talk with the people, and find out how the company failed to meet their needs.
A useful method is to ask "why" five times. Example: "Why did you hire unpaid interns? Because I thought it was legal to do so. Why did you think it was legal to do so? Because the handbook suggested it. Why did the handbook suggest it? Because it was legal to do so when that copy was written twenty years ago. Why are you using a handbook written twenty years ago, instead of the one issued last year? Because we stopped printing the handbooks on paper, and told everyone to go to the corporate website, but the corporate website keeps crashing.". This turns it from a problem with advisers to a problem that your IT team can fix.
D5: Choose and Verify Permanent Corrections. Once you know why things went wrong, think of something you can do that would fix that issue. Perhaps it's updating a handbook, or announcing that your corporate HR team is now available to help advisers with hiring. Before you decide on a corrective action, try it out. Show an adviser a draft of the updated handbook, and see if they understand the wording. Have an adviser call HR for help, and see if HR actually gives the correct advice. You don't want to invest time and effort in making a fix until you know it's going to work.
D6: Implement and Validate Corrective Actions: You know what you want to do - now you do it. But don't stop there - confirm that the fix was actually implemented. If you updated a handbook, call a random adviser and ask them to read you the relevant section from their handbook, so you know that they received the updated copy. Ask a random adviser how they'd go about hiring someone, so you can confirm they heard your announcement that your HR team is there to give them advice. Look for an ad run by an adviser, and call them to confirm that your HR team or compliance team was helpful in crafting the ad.
D7: Take Preventive Measures. During your corrective action process, you found where your system failed to help an adviser. Perhaps a handbook was out of date, and hadn't been updated when labour laws changed in 2000. Perhaps your legal compliance team was only checking some ads, but not all communications leaving the office. You can now step back one step, and consider whether or not this could cause problems in addition to this one specific issue. This is your opportunity to prevent unrelated problems from making you suffer in the future. For example, after updating a handbook, you could schedule it to be reviewed annually by your legal compliance team, in case any other laws change and the handbook goes out of date on other topics. You could have your legal compliance team sit with an adviser and identify all communications they make - perhaps there are other unreviewed gaps, such as posts on Facebook or Twitter, which could be a potential liability for things other than employment law.
D8: Congratulate Your Team. Ask upper management to thank all the people that worked with you to permanently fix the problem. Make sure that they and their immediate superiors know you appreciate their efforts in making the company stronger.
The 8D process isn't the only way [investment company] can investigate and correct legal compliance issues. However, I believe it is more effective than taking things seriously and writing a memo.
[edited to remove personally identifiable information]