Corporate compliance risk assessment, lessons learned

Since I have already written about risks theory and risk management in general, I am now writing more about compliance specific risks and what can a compliance risk assessment tell you.

In order to be able to manage compliance risks, we first need to recognize them. For this purpose we first have to take up a compliance risk assessment and put in place detective controls.

 

 

Actually, ideally we would first take up a structured, well-thought-over compliance risk assessment throughout our organizations. In reality, many do this after having some practice in compliance or specific compliance risk areas, learning about risks as you go, putting down fires and talking to the 'civilians' in an organization.

 

At least this is the situation in our part of the Europe, where compliance program and compliance management are novelties in the system of governance. Compliance as a governance function is hardly starting to show on the map in the corporate world, making its space 'under the stars'. It has to do a lot with adding to the existing checks and balances and changing power distribution in an organization, penetrating into already owned territories, braking Chinese walls sometimes :) Taking up compliance as an independent function from scratch is a great challenge, it means a change and it takes time, a lot of patience and energy. As most of the bigger changes do...

However, at some point compliance officer will take up a compliance risk assessment.

These would be typical dangers and unwanted consequences of incompliance, that you want to detect and locate the source of and prevent:

• Regulatory Inspection and penalties
• Civil damages and compensations
• Criminal prosecution and penalties
• Business loss or lost opportunities (like ban from a public tender)
• Loss or damage in reputation.

These would be typical indicators that help you detect and locate compliance risks:

• Tips from employees in different forms, like asking questions or direct reports of incompliance
• Internal incidents
• Clients' complaints
• Regulators inspection and findings
• Greater law suits and outcomes
• Employee research findings (like ethics surweys, corporate culture or organizational climate research)
• Process reality that differs from rules and procedures.

Analysing all or some of the above would be one way of conducting compliance risk assessment. However, use it as a base for interviewing the directors and key leaders in the company. This is really crucial in an overall corporate compliance risk assessment.

 

And the following are some of the typical drivers of compliance risks - the factors that you can (more or less) influence and thus act in a preventive manner:

• The corporate culture, ethics
• Tone from the top
• Propriety / integrity of persons on top and middle levels and key positions
• Reporting lines
• Policy management and implementation
• Employee education and awareness
• Rewarding system
• Disciplinary consistency
• Compliance communication and training.

We can express compliance risks by the categories in order to measure them.

We can rate low risk as 1 and 2 = not in focus of your attention for now; however you need to observe it regularly;

Middle risk can be rated as 3 and 4 = there is actual danger that something bad will happen, if we don't do something about it eventually; the time span and nature of measures are dependant of the rating of 3 or 4;

High risk as a 5 = this is a red zone, a 'tempted bomb'; you need to react quickly.
 

You can assign these risk grades to an overall business operation, certain business operation, certain events, relationships, business dealings or a business partner. In order to grade a compliance risk, you would usually follow these steps, which are best shown on an example:

 

1. Specify the situation and the risk; what’s the potential danger of something bad happening in certain business operation or a business relationship;

Situation: You are a well known technology products manufacturer from Slovenia and you are building a plant in Bulgaria. You are hiring an experienced contractor there, who will need to attain some licences from the Bulgarian government.

 

Risk: Danger that a contractor is not fit for the task of building a plant properly, which can lead to regulatory fines, accidents could happen etc. There is also a danger that a contractor would offer inappropriate payments to Bulgarian officials in order to attain licences.

You have risk of getting fined or prosecuted for security issues, a corruption and a reputation risk.

 

2. Evaluate the likeliness of that consequence to happen (you have to base it upon certain facts, experience and assumptions);

Security incident = 2

Corruption = 4

Reputation damage = 4

 

3.  Evaluate the severity of that consequence, if it comes true;

Security incident = 4

Corruption = 5

Reputational damage = 5

 

4. Grade the risks accordingly;

Security incident = (2+4)/2 = 3

Corruption = (4+5)/2 = 4, 5

Reputational damage = (4+5)/2= 4, 5.

 

5. Make propositions for mittigating these risks and then monitor;

As a compliance officer you would recommend that the company arranges for extra security supervision in building the plant later, however addres the highest attention to proper practices in the procedures with the Bulgarian government. You could suggest that the (additional) due dilligence of a contractor is conducted, too. You would want to communicate your code of ethics to that contractor and have some of your corporate professionals to escort this contractor through the procedures with the Bulgarian government. Your company will probably need to plan certain delay in starting your Bulgarian plant, due to longer waiting time and administration to attain the permits. But you will protect your good name (which has shown to be highly threatened) and sleep well.

 

Andrijana Bergant,

strongly convinced that a compliance as a business function will mark the future of Slovenian corporations’ governance, and that ethics will become something tangible in terms of business; usable in the process of serious business decision making.