xavGE

Managing risk
compliance programs when making
charging decisions and assessing
penalties.
• It establishes behavioral and
professional expectations for
employees, allowing the company to set
standards in advance and facilitating
termination of employees for
misconduct when rules are not followed.
Assuming a corporate ethics
and compliance program exists,
an organization must still perform
incremental compliance activities, as risks
can and do change over time. Engaging in
an ethics and compliance risk assessment
is one way a company is able to analyze
the effect that ever-changing risks have on
the organization, prioritize these risks and
develop options and actions to reduce the
threat they pose.
Organizations often confuse an
ethics and compliance risk assessment
with a general corporate-wide risk
assessment and are uncertain as to the
scope, frequency and structure of such
an assessment. As an increasing number
of organizations have begun to institute
ethics and compliance risk assessments,
leading practices have started to emerge.
They are as follows:
• Examine all major areas of
misconduct—A common mistake
organizations make when conducting
an ethics and compliance risk
assessment is to limit the potential
risk universe to a preconceived list
of likely high-impact risks. Rather,
a proper ethics and compliance
risk assessment encompasses all
potential risks, including both those
that are systemic to the average
organization and those that are unique
to the industry in which the specific
organization operates.
• Examine risk contextually—To be
effective, the ethics and compliance
risk assessment must take into account
the ability of the organization to plan
for, prevent or mitigate each risk area.
This focus entails examining the
controls, processes and procedures
designed to prevent compliance
failures, as well as assessing the
effectiveness of the individuals in
positions of substantial authority
in recognizing and preventing a
compliance breakdown.
• Address current and potential risks—
An effective ethics and compliance
risk assessment should take into
consideration risks that presently exist,
as well as those activities that are
currently legal but could reasonably be
called into question in the future.
• Review internal and external
information—Ethics and compliance
risk assessments should include an
examination of internal corporate
documents, as well as industry
information and historical incidence
reports. To be adequately predictive,
the ethics and compliance risk
assessment should include not only
compliance breakdowns and failures
but also near-misses.
• Include participants from all levels of
the organization—When collecting and
assessing potential risk areas, ethics
and compliance risk assessments
should involve personnel across
various disciplines and seniority levels.
This can be accomplished through
workshops, focus groups, surveys and
interviews.
• Consider impact and likelihood of
occurrence—Ethics and compliance
risk assessments should weigh risk
areas to account for impact and
likelihood of occurrence. By assigning
quantifiable weights or ratings to each
relevant risk area, organizations will be
able to rank them appropriately.
• Document the outcome—The outcome
of the ethics and compliance risk
assessment should be documented
in a defensible action plan. This plan
should include not only a description
of the process that was followed but
also the actions that were taken to
design, implement or modify the
compliance program.
• Be defensively objective—The ethics
and compliance risk assessment
process should fairly assess the full
universe of the organization’s potential
risks, including existing acceptable
industry practices. Resist the
temptation to ignore or deemphasize
risks because they could be costly to
address from a financial or internal
political perspective.
• Quantify each risk area—The ethics
and compliance risk assessment
process should allow for quantification
of each risk area. An assessment that
goes beyond “likelihood” and “impact”
can be more useful in prioritizing
compliance budget spending and
activities, as well as in justifying
any incremental controls, policies,
processes or spending that must
be implemented. Furthermore, if
executed correctly, such quantification
can be used to measure program
effectiveness, a U.S. Federal
Sentencing Guidelines criterion of
an effective ethics and compliance
program.
• Conduct ethics and compliance
risk assessments periodically—The
frequency with which an organization
chooses to conduct ethics and
compliance risk assessments and
schedule follow-up risk reviews
may depend on the nature of the
organization’s industry. However,
if the methodology and process is
adequately defined, it can reasonably
be conducted on an annual basis,
and year-over-year results can
be appropriately compared. Since
operating environments, regulations
and government enforcement priorities
routinely change, it is inadvisable to
conduct ethics and compliance risk
assessments on a less frequent basis
than every two years.
• Measure employee knowledge—The
ethics and compliance risk assessment
should include a measurement of
employee knowledge, as well as
awareness of the compliance program
and supporting controls. Doing so
can help pinpoint where training and
communications programs need to be
improved.
• Benchmark—When possible, the ethics
and compliance risk assessment should
benchmark against peer organizations.
In addition to industry peers, consider
those organizations that are peers in
terms of size and geographic scope.
This is particularly important as it
ensures that the organization meets
NYSE IPO Guide
95