Fast Growth Without Compliance and Audit Scaffolding Is a Disaster Waiting to Happen

Earlier this week, high-flying business software startup Zenefits got its wings clipped.

The San Francisco-based company, which provides online tools to help small businesses manage their human resources and employee benefits functions, forced out its founder and CEO, Parker Conrad. Conrad’s transgression? He neglected to put the proper internal processes, controls, and compliance practices in place.

The abridged version of Zenefits’s story is that it catapulted to a $4.5 billion valuation and more than 2,000 corporate customers in just two years by providing free cloud-based employee benefits management software. It earns revenue by acting as a broker for healthcare insurance or payroll services. As first reported by BuzzFeed, however, it may have run afoul of insurance laws by allowing employees to operate as brokers in several states without proper licensing.

Based on a letter to employees from COO David Sacks, who is taking over as CEO, the problems ran much deeper than unlicensed insurance brokers. “The fact is that many of our internal processes, controls, and actions around compliance have been inadequate, and some decisions have just been plain wrong,” Sacks said in a letter to all Zenefits employees. “We must admit that the problem goes much deeper than just process. Our culture and tone have been inappropriate for a highly regulated company,” he admitted.

Clearly, Conrad’s brash and irreverent style was great for hyperbolic growth. (He once bragged to a reporter from Fortune that Zenefits’s traditional insurance-broker competitors were “fucked.”) But for building an ethical culture and keeping the company on the right side of insurance regulation?…not so much.

Compliance as an Enabler

The fate of Zenefits’s founder is a cautionary tale for high-flying tech startups and disrupters. Don’t neglect the audit and compliance scaffolding; it is your support system. It’s also a clear demonstration of what internal audit leaders have been saying for years: audit and compliance programs aren’t an inhibitor to fast growth (as Conrad likely believed); they are an enabler. They are the tracks on the high-speed train line that keep the engine and cars on course. They are the guardrails on the speedway that allow you to drive fast without worrying about going off the cliff.

Zenefits is part of a growing hoard of so-called “unicorns” like Uber, Airbnb, and DraftKings that experience meteoric growth and have to scramble to build the governance, compliance, and risk management elements as their rockets move into the orbits of highly regulated traditional businesses. If they move too quickly without getting their compliance house in order, they should expect chaos.

The situation is only made worse because their traditionally-minded competitors are watching ever move and ready to report any regulatory wrongdoing. The argument against many of these companies is that sure disruption is easy when you don’t bother to abide by the regulation. Zenefits found out the hard way that online doesn’t mean above the law.

Now, many start-up CEOs could be forgiven for lagging behind on building out the company’s infrastructure. After all, those entrepreneurial mavens fear that layers of management and administrative process will kill the free-wheeling innovative spirit of their companies. The reality is that compliance programs allow those innovators to think big without going off course. It’s also true that, when done right, you can have compliance and audit programs without adding layers of bureaucracy.

The Zenefits board did the right thing to dump Conrad, and I can only imagine how difficult it was to force out the founder of a company that has grown so rapidly. But there really is no way to change the “culture and tone” of an organization without changing its leader, who plays the biggest part in setting it. Conrad had to go, and the Zenefits boardto their creditunderstood that. Probably the first item on their list will be changing the company motto, which is (and this is true): “Ready, Fire, Aim!” Apparently, that strategy didn’t work out so well.