en en en en en en en en en en en en en en en en id en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en tr en en en en en en en en en en sv en en en en en en en en en en en en en en en en en en en en en en en fa en en en en en en en en en en en en en en en en en en en en en en en en
If you’re renovating your house, a general contractor is critical. He or she oversees the project and knows what needs to be done to execute the vision. But if the pipes aren’t fitted correctly, the general contractor may not see it until water seeps into the newly laid white oak floors. A general contractor is just that — general. They need the assistance of plumbers and electricians — specialists — to get a real view of the risks to the build.
The same is true in the relationship between enterprise risk (also known as integrated risk) and compliance. There’s currently a debate about whether compliance should be subsumed into a singular risk function. While compliance risk is part of a complete risk function, it needs to be separate and its risk assessment process independently managed.
Enterprise risk management can easily work effectively with the compliance function to ensure compliance risk is understood and responded to appropriately. Here are five best practices to ensure smooth sailing.
1. Articulate the Risk Appetite
The board, C-suite, enterprise risk management lead and chief compliance officer need to agree on a risk appetite. Risk appetite simply means the tolerance the company has for risk. Some companies have the “move fast and break things” mentality, where risk is celebrated. This is very different from a stable, long-established enterprise with conservative risk tolerance.
Defining the company’s risk appetite is critical for ensuring that enterprise risk and compliance are working with the same expectations for the imposition of controls on the business. Strict compliance-related controls can slow down the business. For instance, the requirement to perform in-depth due diligence on high-risk third parties may create a delay in signing important contracts. It is critical for the board and C-suite to articulate the company’s risk appetite and for enterprise risk and compliance to work together to ensure the appropriate stringency of controls.
2. Compliance Completes Its Own Separate Risk Assessment
Globally, regulators expect companies to have a compliance-specific risk assessment from which the compliance program is built. For instance, when determining whether a company should get credit for the compliance program in criminal sentencing, the U.S. Department of Justice instructs prosecutors to consider “[t]he effectiveness of the company’s risk assessment and the manner in which the company’s compliance program has been tailored based on that risk assessment.”1 The U.K.’s Ministry of Justice requires a bribery-related risk assessment in order to defend against the strict liability offense of failing to prevent bribery.2 The compliance-related risk assessment should be separate from enterprise risk to conform to regulatory expectations.
At a high level, compliance-related risks should be captured on the enterprise-wide risk register. However, compliance should keep a more detailed risk register that feeds into the enterprise-wide one, but which includes more detail about the risk and mitigation plan.
3. Agree on the Topics to Be Monitored
Ideally, the compliance department will have a charter laying out the laws and issues handled by the function. If a charter exists, use it to define the risks that compliance will monitor. If there is no program charter, ensure enterprise risk and compliance come together to determine exactly which risks will be managed by the compliance department, especially in the risk assessment process.
Some risks will necessarily be spread among functions. For instance, managing modern slavery and human trafficking risk often involves the compliance, corporate social responsibility and procurement departments. Risks that bleed from one department into another must be assigned a primary owner. As the saying goes, the fastest way to starve a pet is to give everyone the responsibility to feed it.
4. Compliance Reports to the Board Directly
Guidance from the Department of Justice is clear: Compliance needs an independent relationship with the board. Prosecutors are instructed to ask whether compliance has direct access to the board of directors or the board’s audit committee.1 Allowing enterprise risk to report to the board on compliance risk is a recipe for disaster. It’s like playing a game of telephone. When one person tries to repeat what was said to them, the message often goes woefully awry. This is especially true when enterprise risk reports on compliance-related risk. No matter how skilled the enterprise risk manager, the depth of knowledge required to explain the compliance-related risk and risk-based approach that should be taken will be missing.
While compliance should always have access to and be able to report to the board, it is critical that compliance report directly in three instances:
When the company’s compliance-related risk profile changes: If the company expands into a new region or creates a new product line, new compliance-related risks will emerge, and the C-suite/board should be briefed on them.
When major compliance-related laws come into place: The compliance lead should report on new laws and report on the plan to deal with them.
When there is a significant investigation or allegation of misconduct.
5. Coordinate with Audit
It’s impossible to know how controls are working without a way to check them. Enterprise risk and compliance should work with internal audit to ensure that perceived risks are e
xplored and that control failures are investigated. Compliance should champion and devise risk mitigation strategies, and internal audit should check to see that they have been implemented effectively. Enterprise risk can stay appraised of the progress while allowing compliance to be primarily responsible for such activity.
Compliance officers’ deep understanding of compliance-related risk and their mandate to prevent, detect, and respond to misconduct is a critically important part of the risk management puzzle. Just as a good general contractor would contact a plumber to look at the pipes before the water comes gushing out, a good enterprise risk manager should rely on compliance to independently manage compliance-related risk.
1 U.S. Department of Justice Criminal Division, Evaluation of Corporate Compliance Programs, https://www.justice.gov/criminal-fraud/page/file/937501/download
2 U.K. Ministry of Justice, Bribery Act 2010 Guidance, https://www.justice.gov.uk/downloads/legislation/bribery-act-2010-guidance.pdf
Kristy Grant-Hart is a compliance and ethics expert specializing in transforming compliance departments into in-demand business assets.
UK Phone: +44 (0)203 514 1443
We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept”, you consent to the use of ALL the cookies.
Do not sell my personal information.
This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary cookies are absolutely essential for the website to function properly. These cookies ensure basic functionalities and security features of the website, anonymously.
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedbacks, and other third-party features.
Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics the number of visitors, bounce rate, traffic source, etc.
Advertisement cookies are used to provide visitors with relevant ads and marketing campaigns. These cookies track visitors across websites and collect information to provide customized ads.
Other uncategorized cookies are those that are being analyzed and have not been classified into a category as yet.