The word “risk” appears 56 times in the 20 pages of the DOJ’s guidance on the evaluation of corporate compliance programs. That’s more than twice per page. The phrase “risk assessment” appears eight times, and “risk-based” four. The DOJ instructs prosecutors to evaluate whether a risk-based approach was taken with respect to training, third-party due diligence, integration into enterprise risk, and the program as a whole.
How can you prove a risk-based approach without a written risk assessment?
Answer: you can’t. When a prosecutor arrives and begins questioning the compliance and management team on how decisions were made, the prosecutor will expect that the answers will flow from a documented, well-thought-out risk assessment. Indeed, “Prosecutors may credit the quality and effectiveness of a risk-based compliance program that devotes appropriate attention and resources to high-risk transactions, even if it fails to prevent an infraction.”
Risk Assessment Isn’t Just Meant to Protect from Prosecution
Hands up anyone who has all the financial, human, temporal, and technological resources they need to run their program with maximum effectiveness. Right. A risk-based approach is critical because it allows you to allocate limited time and money to the highest-risk areas of the business. If there isn’t a proper evaluation of the risks facing the business, there can’t be a systematized, defensible way of designing your program.
Top Tips for Risk Assessment Success
This is the first in a series of blog posts that will reveal top tips for performing a successful risk assessment. The basic flow of any risk assessment is the same: (1) scoping, (2) document collection, (3) interviews, (4) regulatory review/benchmarking, (5) choosing a methodology and evaluating risk, (6) writing the report and creating the heat map, and (7) applying the risk-based approach to the rest of your program. The steps may be the same, but the way you execute them makes all the difference.
Scoping: The Most Important Step
If a risk assessment isn’t properly scoped, it is likely to fail. It will either spiral out of control and be unmanageable or not properly capture the risks facing the business. Getting the scope right will enable you to ask for the right documents, set up the right interviews, review the correct regulatory guidance, benchmark against the right sources, evaluate risk correctly, and apply the right risk-based approach to the rest of your program. Scoping sounds easy, but frequently isn’t.
There are two basic types of risk assessments. The first reviews multiple types of risk against each other. For instance, a multi-subject risk assessment may evaluate the company’s bribery risk against its trade sanctions, antitrust/competition, data privacy, and modern slavery risk. The second type reviews one type of risk in-depth, such as bribery or money-laundering.
Following you’ll find five top tips for scoping your risk assessment. The first two Top Tips relate solely to multi-subject risk assessments, the third solely to single-subject risk assessments, and the last two apply to both types.
Top Tip One: Don’t Go Outside the Scope of Your Program (if you can help it)…
Read More
