Tag: Risk Assessment

Categories
Blog

Risk Assessment Lessons from Star Trek: Balance of Terror

Last month, I wrote a blog post on the tone at the top, exemplified in Star Trek’s Original Series episode, Devil in the Dark. Based on the response, some passionate Star Trek fans are out there. I decided to write a series of blog posts exploring Star Trek: The Original Series episodes as guides to the Hallmarks of an Effective Compliance program set out in the FCPA Resources Guide, 2nd edition. Today, I continue my two-week series, looking at the following 10 hallmarks of an effective compliance program as laid out by the Department of Justice (DOJ) and Securities and Exchange Commission (SEC) in the FCPA Resources Guide, 2nd edition.

The episode Balance of Terror serves as an excellent example of risk assessment. This episode showcases the complexities and importance of evaluating risks in high-stakes situations. In this episode, the USS Enterprise is patrolling the Romulan Neutral Zone when they discover that a series of outposts have been mysteriously destroyed. The Enterprise encounters a Romulan Bird-of-Prey equipped with a powerful cloaking device and an advanced weapon capable of destroying planets. Captain Kirk must assess the risks of engaging the Romulan ship while preventing a potential war. What are some of the key risk assessment lessons?

The Risk is the Romulan threat to the Federation. The episode opens with the Enterprise facing an unknown enemy, the Romulans. This unknown factor presents a significant risk because of the Romulan’s uncertain capabilities. Their technology and tactics are shrouded in mystery, and there is a clear potential for escalation, as any misstep could lead to a full-blown war. Equally important is the impact on Federation security, as the Romulans’ aggressive actions threaten the Federation’s and its citizens’ safety.

Lesson 1 – Identifying Risks

The Enterprise crew must identify the nature and source of the threat the Romulan ship poses. This involves gathering intelligence on the Romulans’ capabilities, tactics, and intentions despite limited information. The risk assessment lesson is that effective risk assessment begins with identifying potential threats and vulnerabilities. Organizations must gather relevant data to understand the nature and scope of risks they face. This includes external threats, such as competitors or geopolitical issues, and internal vulnerabilities, such as process inefficiencies or compliance gaps.

Lesson 2 – Assessing the Risk

Captain Kirk must evaluate the Romulan threat, considering the immediate danger to the Enterprise and the broader implications of a conflict with the Empire. Captain Kirk and his crew engage in a meticulous risk assessment process to gather intelligence by analyzing the Romulan vessel’s capabilities and tactics and then devising a plan to counter the Romulan threat, including deploying a decoy and using deception tactics.

The possibility of igniting a war demands careful consideration of the consequences of each action. The risk assessment lesson is that assessing the potential impact of identified risks is crucial for prioritizing response strategies. Organizations should evaluate the possible consequences of risks in terms of financial loss, reputational damage, operational disruption, and legal implications. Understanding the severity and likelihood of risks helps in developing appropriate mitigation plans.

Lesson 3 – Developing a Risk Mitigation Strategy

Kirk and his crew analyze various response options, weighing the pros and cons of engaging the Romulan ship versus maintaining a defensive stance. They consider strategic maneuvers, potential diplomatic outcomes, and the risks of escalation. The risk assessment lesson is that a comprehensive risk assessment involves analyzing available response options and their associated risks. Organizations should explore different scenarios and develop contingency plans to address potential threats. This includes evaluating the effectiveness and feasibility of risk mitigation strategies and determining the best course of action.

Lesson 4 – Decision-Making Under Uncertainty

Kirk must make critical decisions under conditions of uncertainty, with incomplete information about the Romulans’ intentions and capabilities. Logically and intuition guide his choices, balancing immediate tactical needs with long-term strategic goals. The risk assessment lesson often involves making decisions with limited information. Organizations should develop frameworks for decision-making under uncertainty, incorporating quantitative data and qualitative insights. Open communication and collaboration among stakeholders can enhance the decision-making process.

Lesson 5 – Monitoring and Continuous Improvement

As the situation evolves, Kirk continuously monitors the actions of the Romulan ship and adjusts his strategy accordingly. His ability to adapt to changing circumstances is crucial to the Enterprise’s survival. The lesson in risk assessment is that it is an ongoing process that requires continuous monitoring and adjustment. Organizations should establish mechanisms for tracking the effectiveness of risk mitigation efforts and be prepared to adapt strategies as new information emerges. Regular reviews and updates to risk assessments help ensure that organizations remain responsive to dynamic environments.

Balance of Terror provides a compelling narrative that illustrates the essential elements of risk assessment, from identifying threats to making informed decisions under uncertainty. For compliance professionals and business leaders, the episode underscores the importance of a systematic approach to risk assessment, emphasizing the need for thorough analysis, strategic planning, and adaptability in the face of evolving challenges. By drawing lessons from Captain Kirk’s command decisions, organizations can enhance risk management practices and better navigate complex and uncertain environments.

Join us tomorrow as we consider the lessons on training and ongoing communications from the Star Trek episode The Trouble with Tribbles.

Categories
Blog

Elevating Your Risk Assessment Game with AI and Machine Learning, Part II

We conclude this two-part blog post on using Artificial Intelligence (I) and Machine Learning (ML) in risk assessments. By embracing AI and machine learning, compliance professionals can elevate their risk assessment capabilities, drive more informed decision-making, and position their organizations for long-term success in an increasingly complex and volatile business landscape. Today, we conclude with how to use these tools and some use cases.

When adopting AI-powered risk assessment solutions, compliance functions will face several key challenges, which can be addressed through a well-planned and strategic approach. Key challenges include implementing a robust data governance framework to ensure data quality, integration, and accessibility across the organization. Invest in data cleansing, normalization, and enrichment processes to prepare the data for AI models. You must be able to demonstrate how you got to certain decisions. To do so, you can use tools such as decision trees or logistic regression to explain their decision-making process better.

Your risk management model should ensure the accuracy, reliability, and fairness of the AI-powered risk assessment. To do so, you can establish a comprehensive model validation and governance framework, which includes regular performance monitoring, stress testing, and bias testing. The model validation process involves cross-functional teams, including risk experts, data scientists, and compliance professionals.

Multiple compliance areas lend themselves to use cases for AI and machine learning in risk assessment.

  1. Fraud Detection and Prevention. Machine learning algorithms can analyze transaction data, user behavior patterns, and other relevant information to identify suspicious activities and detect potential fraud in real-time. AI-powered anomaly detection can flag unusual transactions or account activities that deviate from the norm, allowing organizations to investigate fraud risks quickly and mitigate them.
  2. Vendor and Third-Party Risk Management. AI can rapidly assess the risk profiles of vendors, suppliers, and other third parties by aggregating and analyzing structured and unstructured data from various sources, including news reports, social media, and regulatory filings. Machine learning models can continuously monitor third-party relationships, detect changes in risk factors, and provide dynamic risk scoring to support vendor due diligence and ongoing risk mitigation.
  3. Compliance and Regulatory Risk. AI-driven natural language processing can help organizations stay on top of evolving regulatory requirements by automatically scanning and interpreting new laws, regulations, and industry guidelines. Machine learning can assist in identifying potential compliance gaps, policy violations, and other regulatory risks by analyzing internal data, such as employee activities, communications, and transactions.
  4. Operational Risk Assessment. AI and machine learning can model and simulate complex business processes, identify potential points of failure, and predict the likelihood and impact of operational disruptions. These technologies can also be leveraged to monitor and analyze real-time data from IoT devices, sensors, and other operational systems to detect anomalies and emerging risks.
  5. Enterprise Risk Management. AI-powered risk aggregation and correlation analysis can help organizations gain a more holistic, enterprise-wide view of their risk landscape, identifying interdependencies and potential risk concentrations. Machine learning algorithms can assist in prioritizing risks based on factors such as likelihood, impact, and velocity, enabling more informed decision-making and resource allocation.
  6. Emerging Risk Identification. AI and machine learning can scour vast amounts of external data, including news, social media, and industry reports, to identify emerging risks and trends that may not be apparent through traditional risk assessment methods. These technologies can also simulate future scenarios and stress test the organization’s resilience against potential black swan events or disruptive changes in the business environment.

By focusing on these traditional corporate risks, compliance professionals can enhance their risk assessment capabilities, improve decision-making, and better position themselves to navigate the increasingly complex and dynamic risk landscape. Integrating AI and machine learning into risk assessment requires a strategic, well-planned approach, commitment to continuous improvement, and a culture of innovation.

As you embark on this transformative journey, remember that integrating AI and ML is not a one-time event but a continuous refinement, learning, and adaptation process. Stay agile, keep an open mind, and be prepared to navigate the evolving compliance and risk management landscape.

The future of risk assessment is here, and it is powered by the extraordinary potential of artificial intelligence and machine learning for compliance professionals. Embrace this opportunity to unlock new levels of insight, efficiency, and proactivity – and lead your organization towards a more resilient and compliant future.

Categories
Blog

Elevating Your Risk Assessment Game with AI and Machine Learning, Part I

I am on a mission to explore how AI and machine learning (ML) can impact the compliance profession, the compliance profession, and the corporate compliance function. Today, I want to explore using AI and ML in risk assessment. I believe that they both have the potential to transform the way we approach risk identification, analysis, and mitigation. By harnessing the capabilities of AI and ML, compliance teams can elevate their risk assessment game and position their organizations for long-term success. Today, in Part I, we consider why you should utilize AI and ML in your risk assessment process and the first steps to take.

For years, organizations have relied on manual, human-driven risk assessment approaches. This often involves painstaking data gathering, expert interviews, document reviews, and applying risk frameworks and methodologies. While these time-tested methods have their merits, they are inherently limited in several ways:

  • Subjectivity and Bias: Human risk assessors bring their own experiences, perspectives, and biases to the table, which can lead to inconsistent or skewed risk evaluations.
  • Scalability Challenges: As businesses grow in size and complexity, manually assessing every risk factor becomes overwhelming and resource-intensive.
  • Reactivity vs. Proactivity: Traditional risk assessment tends to be retrospective, focusing on known or historical risks. Anticipating emerging threats requires a more forward-looking, proactive approach.
  • Lack of Real-Time Responsiveness: The pace of change in today’s business environment means that risk profiles can shift rapidly. Manual processes may need help to keep up with these dynamic conditions.

AI and ML offer promising solutions to overcome the limitations of manual risk assessment. By leveraging these technologies, compliance teams can identify a more significant overall set of risks. AI-powered systems can scour vast internal and external datasets to uncover potential risk factors that human analysts may have overlooked. Machine learning algorithms can identify patterns, anomalies, and correlations, providing a more comprehensive, data-driven view of the risk landscape.

However, it is not simply the ability to uncover more risks through greater data sets but also the ability to use AI and ML tools. Compliance professionals can quantify and model risk variables with greater precision, considering a broader range of factors and their interdependencies. This allows for more accurate risk scoring, prioritization, and scenario planning. This leads directly to anticipating emerging threats and vulnerabilities, empowering organizations to take proactive measures.

Consistency and objectivity are critical for any risk assessment. In this area, AI and ML-based systems can apply consistent, standardized risk assessment methodologies, reducing the impact of individual biases and subjectivity. Automated risk assessment powered by AI and ML can also process large volumes of data and handle complex risk evaluation tasks, freeing compliance professionals to focus on strategic decision-making. The goal is to move towards a more continual monitoring system, and here,  AI-driven risk assessment can be integrated into real-time monitoring and alert systems, allowing organizations to quickly identify and respond to changes in their risk profiles.

How does a compliance function implement all of this AI and ML? There are several steps you should consider.

  • Assess Your Data Readiness: Effective AI and ML-powered risk assessment relies on high-quality, structured data availability. The DOJ mandates that you have access to your company’s data, including identifying any gaps or limitations and developing a plan to enhance data governance and management.
  • Identify Use Cases and Prioritize: Conduct a thorough analysis of your risk assessment needs and pain points. In other words, what are your high-risk areas? Determine which specific areas – such as fraud detection, vendor risk management, or third parties – could benefit the most from AI and ML-driven solutions.
  • Evaluate and Select the Right Tools: Research and evaluate a range of AI and ML-powered risk assessment platforms and solutions. Consider factors like integration capabilities, user-friendliness (it’s all about the UX), scalability, and the provider’s track record in compliance and risk management.
  • Pilot and Iterate: Start with a targeted pilot project to test the viability and effectiveness of your chosen AI and ML-based risk assessment approach. (Hint: Start small with a low-risk target.) Closely monitor the results, gather feedback, and continuously refine the solution to optimize its performance.
  • Train Your Team: Ensure compliance and risk management professionals have the necessary skills and knowledge to effectively leverage AI and ML technologies. Invest in training, workshops, and collaboration with data science and technology experts.
  • Establish Governance and Oversight: Develop robust governance frameworks to ensure the responsible and ethical use of AI and ML in risk assessment. This includes addressing algorithm bias, data privacy, and human oversight.
  • Foster a Culture of Innovation: Encourage a mindset of continuous improvement and experimentation within your compliance function. Empower team members to explore new ways of leveraging emerging technologies to enhance risk assessment and drive organizational resilience.

Join us tomorrow to consider implementation and some compliance use cases.

Categories
Compliance Tip of the Day

Compliance Tip of the Day: Why Use Ai and ML in Risk Assessments?

Welcome to “Compliance Tip of the Day,” the podcast where we bring you daily insights and practical advice on navigating the ever-evolving landscape of compliance and regulatory requirements.

Whether you’re a seasoned compliance professional or just starting your journey, our aim is to provide you with bite-sized, actionable tips to help you stay on top of your compliance game.

Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law.

Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

In this episode, we consider why you should move away from human-driven risk assessment to AI and ML-assisted risk assessments.

For more information on the Ethico ROI Calculator and a free White Paper on the ROI of Compliance, click here.

Categories
Blog

Culture Week: Part 5 – A Listening Tour to Improve Culture

We conclude our focus on culture this week by returning to some of our long-time compliance roots for improving culture, such as the listening tour. In 2022, returning Starbucks Chief Executive Officer (CEO) Howard Schultz began engaging in a “listening tour” of Starbucks stores literally across America. In an article by Justin Bariso, he said Schultz told employees, “We are traveling the country, trying to, with great sensitivity, understand from you how can we do better.” What are employees telling him? Bariso wrote, “he listens intently to one Starbucks employee after another; a pained look comes over Schultz’s face. Employees lament the lack of training, increased turnover, and extreme pressure they’ve endured as company profits soared, but worker conditions plummeted.”

This listening tour has several goals for Schultz. The first is that even though the company has sustained record profits, morale at the company is at an all-time low. Witness the unionizing efforts that have been successful. Employees are simply fed up with not being listened to. This has eroded employee trust and management and driven down the once vibrant culture at the iconic institution. To rebuild that trust, Starbucks, as their CEO, “must first listen.” However, it is more than simply listening to rebuild trust; it is rebuilding employee engagement by making them and their ideas part of the solution.

There is still much work for Starbucks and Schultz to do. Yet these initial steps can lead to real change. Schultz is doing more than saying “We Care”; he is modeling that language in his behavior. This is action at the top. It also communicates to other senior management that they must listen to re-engage and build employee trust. What if a Chief Compliance Officer took that same approach to culture? I believe that a Schulz-inspired listening tour can improve your corporate culture. Below are three keys for the compliance officer to conduct a practical listening tour.

A. Engagement

Start by meeting as many compliance stakeholders as possible. You can use town hall settings or go smaller, meeting with key employee leaders, key stakeholders, and employees identified as high-risk who you can meet with individually or in smaller groups. Listen to their compliance concerns and take their compliance ideas back to the home office. After returning to your office, winnow down their ideas and suggestions to form the basis of enhancements to your culture. This employee engagement will lead to greater stakeholder buy-in for your culture.

B. Education

During the town hall meetings and the smaller, more informal group meetings, you can do more than simply listen—you can also train. This training is on ethics and how the employees could use compliance as a business tool. Most business’s ethical standards are not found in an existing compliance program. They are found in the general anti-discrimination guidelines and ethical business practices such as anti-competitiveness and prohibition of using confidential information. Often, these general concepts can be found in a company’s overall Code of Conduct or similar statement of business ethics. Workplace anti-discrimination and anti-harassment guidelines can be found in Human Resource policies and procedures. Concepts such as anti-competitiveness and the use of customers’ and competitors’ illegally obtained confidential information may be found in antitrust or other business practice-focused guidelines.

This gets your employees and other stakeholders thinking about doing business ethically. It is ethical concept-based training, in contrast to a rules-based approach. Moreover, this lays the groundwork for enhancing your culture and the training that will occur as the enhancement is rolled out.

C. Risk Assessment

Now, think about this same approach from the risk assessment perspective. Listen to your employees’ concerns and compliance issues. From there, you can ask questions about what was done and why. This approach is not adversarial or interrogation, but it is ferreting out the employees’ concerns while having the employees educate your compliance team on the actual procedures that are used. By listening and gently questioning, you should garner enough information to create a risk assessment profile that can inform and even become the basis of compliance program enhancements.

Bariso concluded his article by stating, “People lose motivation when they sense you don’t care. But the simple act of listening creates goodwill. When your people feel understood, they’ll be motivated to contribute and can help you discover insights you wouldn’t otherwise. So, when it comes to solving your company’s biggest problems, don’t ignore your most helpful resource: your people.” It all starts with listening. Let your employees and other stakeholders have the “chance to share their problems, as well as to propose solutions. Meetings like these will reveal key insights and transform your people from employees to partners.”

I hope you have enjoyed and, more importantly, found this week’s blog posts on helpful culture. I also hope you will join the conversation by commenting or posting on LinkedIn about your experiences around corporate culture.

Categories
Blog

Changing Sales Models

Over the past 12 months or so, there have been a series of Foreign Corrupt Practices Act (FCPA) enforcement actions in which the respondents have changed and/or modified their sales models to move away from external third parties and toward direct sales and business generation models. This portends a change in the way the Department of Justice (DOJ) may think about sales models, their inherent risk, and risk management going forward. These FCPA enforcement actions involved Albemarle, SAP, Gunvor, and Trafigura.

Albemarle

The Albemarle Non-Prosecution Agreement (NPA) cited several remedial actions by the company that helped Albemarle obtain a superior result in terms of the discounted fine and penalty. These steps were taken during the pendency of the DOJ investigation so that when the parties were ready to resolve the matter, Albemarle had built out and tested an effective compliance program. The company shifted to a direct sales business model.

This change was relatively new and undoubtedly noteworthy for FCPA enforcement actions, which were changes in a company’s approach to sales and their sales teams. Obviously, corrupt third-party agents brought the company to such FCPA grief. Many of the quotes in the NPA make it clear that Albemarle executives had an aversion to paying bribes but had greater moral flexibility when a third-party agent was involved. This led to the company moving away from third-party agents to a direct sales force.

SAP

While most of the remediation reported in this matter was standard, the one item that every compliance professional should consider is that SAP proactively discontinued using third-party agents for business origination. The point is perhaps the most significant, as the DOJ called out SAP for discontinuing their use of third-party agents. The DOJ information sets out the following: Change in sales models. On the external sales side, SAP eliminated its third-party sales commission model globally, prohibited all sales commissions for public sector contracts in high-risk markets, and enhanced compliance monitoring and audit programs, including creating a well-resourced team devoted to audits of third-party partners and suppliers.

Gunvor

As I noted in my review of the Albemarle and SAP enforcement actions, SAP eliminated its third-party sales commission model globally and prohibited all sales commissions for public sector contracts in high-risk markets. It also enhanced compliance monitoring and audit programs, including the creation of a well-resourced team devoted to audits of third-party partners and suppliers. Albemarle changed its approach to sales and its sales teams. Guvnor also moved away from third-party agents to a direct sales force.

Trafigura

Trafigura eliminated the use of third-party business origination agents. Matt Kelly noted in Radical Compliance, “This is the latest in a string of FCPA enforcement cases where we’ve seen a big, structural change to the sale function. Albemarle eliminated its use of third-party sales agents as part of its FCPA settlement last year; SAP eliminated its third-party sales commission model globally as part of its own FCPA settlement announced in January. Now we have a third global enterprise going that same route, reducing its FCPA risk in a deep, permanent way by restructuring its sales operations.” Here, Trafigura did away with third-party representatives for business generation.

In these four recent enforcement actions, the companies changed their approach to sales and their sales teams and did away with third parties generating new business. All of this points to these companies moving away from third-party agents to a direct sales force.

Moving to a direct sales force does have its risks, which must be managed, but those risks can certainly be managed with an appropriate risk management strategy, monitoring of the strategy, and improvement; those risks can be managed. Yet there is another reason, and more importantly, a significant business reason, to move towards a direct sales business model. Every time you have third-party agent or anyone else between you and your customer, you risk losing that customer because your organization does not have a direct relationship with the customer. A direct sales business model will give your organization more direct access to your customers.

The fact that the 2020 FCPA Resource Guide, 2nd edition, and the 2023 Evaluation of Corporate Compliance Programs do not outline this strategy is another intriguing aspect of how Albemarle, SAP, Gunvor, and Trafigura use it. These are all approaches developed by the companies based upon their own analysis and risk models. It may have come from a realization that the risk involved with third-party sales models was simply too significant, that the companies wanted more control over their sales or some other reason. Whatever the reason for the change, the DOJ took note of each organization and viewed it affirmatively.

Every compliance professional should understand that this is how new ideas are developed by the DOJ and in compliance. Companies assess their own risks and then move forward to manage or change their risk profiles. Expect to start seeing and hearing more about the direct sales model for the DOJ. This is where the DOJ’s comments on compensation incentives and consequence management will come into play.

Categories
Compliance Tip of the Day

Compliance Tip of the Day: Human Rights Abuse Risk Assessment and Strategy

Welcome to “Compliance Tip of the Day,” the podcast where we bring you daily insights and practical advice on navigating the ever-evolving landscape of compliance and regulatory requirements.

Whether you’re a seasoned compliance professional or just starting your journey, our aim is to provide you with bite-sized, actionable tips to help you stay on top of your compliance game.

Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

In this episode, we look at how you can assess your human rights abuse risk and put together a risk management strategy.

For more information on Ethico and a free White Paper on top compliance issues in 2024, click here.

Categories
Compliance Tip of the Day

Compliance Tip of the Day: Continually Evolving Compliance

Welcome to “Compliance Tip of the Day,” the podcast where we bring you daily insights and practical advice on navigating the ever-evolving landscape of compliance and regulatory requirements.

Whether you’re a seasoned compliance professional or just starting your journey, our aim is to provide you with bite-sized, actionable tips to help you stay on top of your compliance game.

Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

In this episode, we consider how your compliance program should continually evolve from your Code of Conduct to Risk Assessment to Continuous Improvement, all in a process oriented, documented approach.

For more information on Ethico and a free White Paper on top compliance issues in 2024, click here.

Categories
Blog

How to Evaluate a Risk Assessment

After you complete your risk assessment, you must then translate it into a risk profile. If your estimate of where your bribery risk is greatest is wrong, it will be an effort to address it. As Ben Locwin explained in his BioProcess International article, entitled, Quality Risk Assessment and Management Strategies for Biopharmaceutical Companies:

Once we have assessed risks and determined a process that includes options to resolve and manage those risks whenever appropriate, then we can decide the level of resources with which to prioritize them. There always will be latent risks: those that we understand are there but that we cannot chase forever. But we need to make sure we have classified them correctly. With a good understanding of each of these, we are in a better position to speak about the quality of our businesses.

William C. Athanas, a partner in Holland and Knight, in an article in Industry Week entitled, Rethinking FCPA Compliance Strategies in a New Era of Enforcement, posited that companies assume that FCPA violations follow a bell curve in which most employees are responsible for most of the violations. However, Athanas believed that the distribution pattern more closely follows a hockey-stick distribution, where virtually all violations are committed by just a few people. Athanas concluded by noting that is this limited group of employees, or what he terms the “shaft of the hockey-stick,” to which a company should devote the majority of its compliance resources. With a proper risk assessment, a company can then focus its compliance efforts such as intensive training sessions or detailed analysis of key financial transactions involving those employees with the greatest means and motive to commit a violation.

The 2023 ECCP provided the following:

Risk Management Process—What methodology has the company used to identify, analyze, and address the particular risks it faces? What information or metrics has the company collected and used to help detect the type of misconduct in question? How have the information or metrics informed the company’s compliance program?

Updates and Revisions—Is the risk assessment current and subject to periodic review? Is the periodic review limited to a “snapshot” in time or based upon continuous access to operational data and information across functions? Has the periodic review led to updates in policies, procedures, and controls? Do these updates account for risks discovered through misconduct or other problems with the compliance program?

In the Treasury Department’s 2019 Framework for OFAC Compliance Commitments (OFAC Framework), the provided greater clarity by stating in the section entitled, Risk Assessments, the following:

II. The organization has developed a methodology to identify, analyze, and address the particular risks it identifies. As appropriate, the risk assessment will be updated to account for the conduct and root causes of any apparent violations or systemic deficiencies identified by the organization during the routine course of business, for example, through a testing or audit function.

A way to evaluate risks as determined by the company’s risk assessment is through a risk matrix. Once risks are identified, they are then rated according to their significance and likelihood of occurring, and then plotted on a heat map to determine their priority. The most significant risks with the greatest likelihood of occurring are deemed the priority risks, which become the focus of your remedial efforts or for continuous auditing. A variety of solutions and tools can be used to manage these risks going forward, but the key step is to evaluate and rate these risks. All your actions should flow from the risk ranking.

There are several ways to look at ‘Likelihood’ factors. An Event can be highly likely if it is expected to occur. An Event can be likely with a strong possibility than an event will occur Event may occur at some point, even if there is no history to support it. It can be possible and there is sufficient historical incidence to support it. Finally, an Event can be unlikely and not expected, with only a slight possibility that it may occur. Responses to likelihood factors to consider include the existence of controls, written policies and procedures designed to mitigate risk capable of leadership to recognize and prevent a compliance breakdown; compliance failures or near misses; and training and awareness programs.

The priority rating is the likelihood rating and ratings that reflect the significance of particular risk universe. It is not a measure of compliance effectiveness or to compare efforts, controls or programs against peer groups.

The most significant risks with the greatest likelihood of occurring are deemed to be the priority risks. These become the focus of your most significant risk management efforts, couple with audit and monitoring going forward. A variety of tools can be used to continuously monitoring risk going forward. Consider providing employees with substantive training to guard against the most significant risks coming to pass and to keep the key messages fresh and top of mind. It is important to create a risk control summary that succinctly documents the nature of the risk and the actions taken to mitigate it. Finally, let this risk assessment and evaluation inform your compliance program, rather than letting the compliance program inform the risk assessment.

Categories
Blog

Risk Assessments

One cannot really say enough about risk assessments in the context of anti-corruption programs. This is because every corporate compliance program should be based on a risk assessment, on an understanding of your organization’s business from the commercial perspective, on how your organization has identified, assessed, and defined its risk profile and, finally, on the degree to which the program devotes appropriate scrutiny and resources to this range of risks. The 2023 ECCP added a new emphasis on the cadence of Risk Assessments, mandating that risk assessments should be done not less than annually, but in reality it should be done each time your risk changes. Over the past couple of years, every company’s risks changed in going to Work From Home to Return to the Office to the Hybrid Work environments of 2024. What about geopolitical issues, supply chain or even potential compliance risks in the 2024 election cycle. Have you assessed each of these new paradigms for risks from the compliance perspective?

As far back as 1999, in the Metcalf & Eddy enforcement action, the DOJ has said that risk assessments that measure the likelihood and severity of possible FCPA violations should direct your resources to manage these risks. The 2012 FCPA Guidance stated it succinctly when it said, “Assessment of risk is fundamental to developing a strong compliance program and is another factor DOJ and SEC evaluate when assessing a company’s compliance program.”

Having made clear what was risks needed to be assessed, the 2023 ECCP was focused on the methodology used in the risk assess process. It stated:

Risk Management Process—What methodology has the company used to identify, analyze, and address the particular risks it faces? What information or metrics has the company collected and used to help detect the type of misconduct in question? How have the information or metrics informed the company’s compliance program?

Risk-Tailored Resource Allocation—Does the company devote a disproportionate amount of time to policing low-risk areas instead of high-risk areas, such as questionable payments to third-party consultants, suspicious trading activity, or excessive discounts to resellers and distributors? Does the company give greater scrutiny, as warranted, to high-risk transactions (for instance, a large-dollar contract with a government agency in a high-risk country) than more modest and routine hospitality and entertainment?

Updates and Revisions—Is the risk assessment current and subject to periodic review? Is the periodic review limited to a “snapshot” in time or based upon continuous access to operational data and information across functions? Has the periodic review led to updates in policies, procedures, and controls? Do these updates account for risks discovered through misconduct or other problems with the compliance program?

Rick Messick, in his article, entitled, Corruption Risk Assessments: Am I Missing Something?, laid out the four steps of a risk assessment as follows:

First, all conceivable forms of corruption to which the organization, the activity, the sector, or the project might be exposed is catalogued. Second, an estimate of how likely it is that each of the possible forms of corruption will occur is prepared and third an estimate of the harm that will result if each occurrence is developed. The fourth step combines the chances of occurrence with the probability of its impact to produce a list of risks by priority.

What should you assess? In 2011, the DOJ concluded three FCPA enforcement actions which specified factors that a company should review when making a risk assessment. The three enforcement actions, involving Alcatel-Lucent S.A., Maxwell Technologies Inc. and Tyson Foods Inc., all had common areas that the DOJ indicated were compliance risk areas which should be evaluated for a minimum best practices compliance program. The Alcatel-Lucent and Maxwell Technologies Deferred Prosecution Agreements (DPAs) listed seven areas of risk to be assessed, which are still relevant today:

1. Where your company does business;

2. Geography-where does your Company do business;

3. Interaction with types and levels of governments;

4. Industrial sector of operations;

5. Involvement with joint ventures;

6. Licenses and permits in operations; and

7. Degree of government oversight.

The 2020 FCPA Resource Guide, 2nd edition, laid out the following approach, “Factors to consider, for instance, include risks presented by: the country and industry sector, the business opportunity, potential business partners, level of involvement with governments, amount of government regulation and oversight, and exposure to customs and immigration in conducting business affairs. When assessing a company’s compliance program, DOJ and SEC take into account whether and to what degree a company analyzes and addresses the particular risks it faces.”

Another approach, as detailed by David Lawler in his book Frequently Asked Questions in Anti-Bribery and Corruption, is to break the risk areas into the following categories: 1) company risk, 2) country risk, 3) sector risk, 4) transaction risk, and 5) business partnership risk. He further detailed these categories as follows:

Company risk. Lawler believes this is “only to be likely to be relevant when assessing a number of different companies—either when managing a portfolio of companies from the perspective of a head office of a conglomerate or private equity house.” High risk companies involve some of the following characteristics:

• Private companies with a close shareholder group;

• Large, diverse and complex groups with a decentralized management structure;

• An autocratic top management;

• A previous history of compliance issues; and/or

• Poor marketplace perception

Country risk. This area involves countries which have a high reported level or perception of corruption, have failed to enact effective anti-corruption legislation and have a failure to be transparent in procurement and investment policies. The Transparency International Corruption Perceptions Index (TI-CPI) can be a good starting point. Other indices you might consider are the Worldwide Governance Indicators and the Global Integrity index.

Sector risk. These involve areas that require a significant amount of government licensing or permitting to do business in a country. It includes the usual suspects of:

• Extractive industries;

• Oil and gas services;

• Large scale infrastructure areas;

• Telecoms;

• Pharmaceutical, medical device and healthcare; and/or

• Financial services

Transaction risk. Lawler says this risk “first and foremost identifies and analyses the financial aspects of a payment or deal. This means that it is necessary to think about where your money is ending up.” Indicia of transaction risk include:

• High reward projects;

• Involves many contractor or other third-party intermediaries; and/or

• Do not appear to have a clear legitimate object

Business partnership risk. This prong recognizes that certain manners of doing business present more corruption risk than others and may include:

• Use of third-party representatives in transactions with foreign government officials;

• A number of consortium partners or joint ventures partners; and/or

• Relationships with politically exposed persons (PEPs)

There are a number of ways you can slice and dice your basic risk assessment inquiry. As with almost all FCPA compliance, it is important that your protocol be well thought out. If you use one, some or all of the above as your basic inquiries for your risk analysis, it should be acceptable for your starting point.