Compliance Risk Assessments - An Introduction

Option 1: Adopt a risk universe identified by similarly situated businesses.

One of the simplest ways to identify your individualized risk universe—if available in your industry and region of the world—is to find lists of federal, regional, and local laws and regulations identified by other similar businesses or organizations. Using predetermined lists of applicable laws from organizations recognized in your country or region provides instant credibility when you are presenting the lists to your compliance partners, compliance committees, CEO, and board. However, efforts to identify applicable laws should not end with simply finding a good “list” from another entity. Due diligence by your legal office, CFO, COO, and other employees to identify any other specific laws affecting your company is also important and necessary.

Standards developed by government legal and regulatory bodies are good examples of pre-identified lists that could form the basis for a compliance risk assessment. In the United States, that could include agencies such as the Occupational Safety and Health Administration (OSHA), the Department of Health and Human Services (HHS), the Environmental Protection Agency (EPA), the Federal Deposit Insurance Corporation (FDIC), or any other relevant federal regulatory agency. In the European Union, that could include the European Commission as well as each country’s governmental authorities. Another good source is non-governmental organizations that develop standards, such as ASIS International (formerly the American Society for Industrial Security), in its standards and guidelines for security professionals; or the International Association of Privacy Professionals (IAPP), for its privacy standards; or the Higher Education Alliance and its Compliance Matrix, developed in conjunction with the National Association of College and University Attorneys. Good lists can also be found through international standards-setting organizations such as ISO and its ISO 19600:2014 (which provides international standards for compliance management systems);^[4] or COSO’s Compendium of Examples,^[5] a companion document to the 2017 COSO ERM—Integrated Framework. Substantial new laws also tend to come with governmental guidance that can help with risk assessments, such as the EU’s General Data Protection Regulation,^[6] the UK’s Bribery Act 2010^[7] , or the U.S. Foreign Corrupt Practices Act.^[8] Indeed, in your particular industry and region of the world, it is likely that specific rules regulate your business—identification of those laws and regulations would be used to develop your compliance risk universe.

Option 2: Conduct interviews of key employees to determine applicable laws and regulations that they deal with every day or year.

With these personal interviews, you can identify key laws that must be part of your compliance efforts and you can identify key noncompliance issues. This method is more time-consuming than Option 1, identified above, but it will result in a better initial understanding of the laws and the concerns faced by your employees who are charged with day-to-day operational compliance concerns. Nothing can ever replace an in-depth conversation between a compliance officer and the person responsible for ensuring compliance with a law. Both these individuals are concerned about a possible noncompliance issue and both are focused on trying to determine how best to proactively address the matter.

However, use caution if this method is your only means of identifying your risk universe. The managers being interviewed may not know what they do not know. In other words, are you sure that the employees you interview know all the laws relevant to their specific area? What about laws that cross functional areas? How will you find out about those? Also, if the interviewee is not being fully forthcoming with you regarding noncompliance concerns, you may get an initial biased view about noncompliance issues that may later influence your risk mitigation plan. These concerns can be dealt with by follow-up due diligence research on what laws are applicable to your business as well as follow-up interviews about noncompliance issues when the risk mitigation plan begins to take shape.

Option 3: Send out surveys to key managers and administrators to determine applicable laws and regulations that they deal with every day or every year.

There are two ways to approach this method. One approach is to create an initial survey that would be broad in nature since this survey seeks identification of the laws. The survey recipient would identify laws applicable to his or her areas of expertise and then would send this information back to a centralized location for compilation. Option 3 is similar to Option 2 described above, since you are asking a manager to identify the laws being dealt with on a daily or less frequent basis. If you use this method to identify your risk universe, a subsequent survey would be designed to capture assessment data.

Another approach is to combine this initial survey with a survey seeking assessment data. Using the same survey instrument, the survey recipient would not only identify the law but also provide information and possible documentation on assessments to determine if the business is or is not in compliance with the law.

Regardless of whether you choose the initial survey or survey and assessment method, the concern about scope of knowledge is present here also—does the manager know what he or she doesn’t know? One would assume (and hope) that the employee charged with ensuring compliance would not only know there is a law but also know that the corporation is or is not in full compliance with that law. However, this may be a hope and not a reality.

Being mindful of this concern, using this survey method brings some extra benefits. It will consume less time than conducting personal interviews, force the recipients to put into writing what laws they know about, and initially identify the applicable laws. If you choose this method, it’s critical to use due diligence, research, and follow-up to confirm the scope of your risk universe.

Which method is best for your business? Customization is the continuing key for all elements of this compliance risk assessment process. But remember—initially starting with a manageable number of laws or regulations to assess will probably cause you less heartburn and will result in a more in-depth assessment of the particular laws.