en en en en en en en en en en en en en en en en id en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en tr en en en en en en en en en en sv en en en en en en en en en en en en en en en en en en en en en en en fa en en en en en en en en en en en en en en en en en en en en en en en en
It’s the most wonderful time of the year… no, not the holidays – Budget Season! It’s the time we cry and fight and claw our way into next year, making the case for what we need.  Sometimes you know exactly what is called for, but other years it can be difficult to know what to request.  No need to worry, we’ve got you covered.  Here’s the ultimate checklist to get what you need.
1.     Third-Party Due Diligence Reports
A risk-based approach to due diligence necessitates that higher-risk third-parties receive greater due diligence than lower-risk third-parties.  You need to have budget to request deeper dive reports – whether that means that a human who speaks the local language is performing a deep-dive desktop review, or, for your highest-risk third-parties, an on-the-ground review including reputation checks from various sources.  These reports can get expensive, but having a budget for at least a few will make your program significantly more defensible if there’s an investigation.
Everyone knows that the most effective training is done in person.  There’s nothing like being on the ground in a high-risk territory to find out what’s really happening.  You can answer questions in real-time during training, and follow-up to ensure that people understood what you were saying.  Asking for a travel budget is critical.  If you can’t get a travel budget, at least try to get budget for an online face-to-face tool like Zoom or Adobe Connect.  Seeing someone’s face is the best way to engage.
3.     A Professional Risk Assessment
The DOJ’s recent Evaluation of Corporate Compliance Programs guidance made it clear: if you don’t have a current risk assessment, you need to make it your priority to get one. The guidance repeatedly emphasizes the need for a risk-based program.  This is true regarding the assignment of training, level of due diligence required for your third-parties, response to investigations, and where you assign your human and monetary resources.  If you haven’t had time or don’t know how to perform a risk assessment, add a line item for a professional risk assessment into your budget for next year.
The DOJ guidance states that companies must have a robust whistle-blowing process, and this process must include, “pro-active measure to create a workplace atmosphere without fear of retaliation, appropriate processes for the submission of complaints, and processes to protect whistle-blowers.”  Companies can expect to be asked whether they have a whistle-blowing procedure, “and if not, why not?”  Why not indeed.  If you don’t have a whistle-blower hotline or process, make this a high priority for budget allocation.
The DOJ guidance is clear: organizations must engage in a periodic review to ensure their programs stay up-to-date.  This evaluation must include “a gap analysis to determine if particular areas of risk are not sufficiently addressed in its policies, controls, or training.”  You can do a compliance program review in-house, or engage an external firm (like Spark Compliance Consulting) to perform your evaluation.  Outside consultants have experience of best practices and are able to provide insights that you won’t have from the inside.  Best practice is to complete a program review every 24 to 36 months.
You need to remind people of your program, including your whistle-blower mechanisms.  To do so, you need materials.  A communications budget can be used to create and print posters to put up in your offices reminding people of the Ethics Helpline.  The budget can also be used to produce games, lanyards, or materials for Compliance and Ethics Week.  Clever design and interesting schwag can make your program memorable to employees when they’re under stress, and that’s worth buying into.
There are some incredible technology solutions on that market that will blow your Excel chart out of the water.  You can ask for software that will assist you in many ways.  These include:
Investigation management software (including analysis and reporting)
Conflicts of interest management
Third-party management software (including audit trails, report storage, and easy review of whether a third-party has been approved)
Data audit/data mapping software to help you comply with GDPR and CCPA
Learning management systems to help track your training assignments and completions
And more!  As you can see, there are many ways to spend your budget, and prioritizing using a risk-based approach is critical for your program.
If your budget negotiations begin to fail, remind your C-suite and Board that if there is a compliance failure, a prosecutor will ask, “Have there been times when requests for resources by compliance and control functions have been denied, and, if so, on what grounds?”  If they deny, it’s at their own risk.
Use our handy checklist below to decide which solutions to request for next year.
Third-Party Due Diligence Reports
Conflicts of interest management
Data audit/data mapping software
Kristy Grant-Hart is a compliance and ethics expert specializing in transforming compliance departments into in-demand business assets.
UK Phone: +44 (0)203 514 1443
We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept”, you consent to the use of ALL the cookies.
Do not sell my personal information.
This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary cookies are absolutely essential for the website to function properly. These cookies ensure basic functionalities and security features of the website, anonymously.
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedbacks, and other third-party features.
Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics the number of visitors, bounce rate, traffic source, etc.
Advertisement cookies are used to provide visitors with relevant ads and marketing campaigns. These cookies track visitors across websites and collect information to provide customized ads.
Other uncategorized cookies are those that are being analyzed and have not been classified into a category as yet.