Please feel free to contact me anytime to share your thoughts: +1 612.357.1544 (cell), +1 952.567.6215 (direct), gerry.zack@corporatecompliance.org.
As usual, Joe Murphy wrote an excellent column this month dealing with risk assessments.[1] We must be leading parallel lives, because I also had an idea about risk assessments I wanted to share.
Most readers use some variation of the same model for risk assessments, involving identification of risks, assessing severity via measurements of likelihood and impact, and measuring the mitigating effect of internal controls over compliance, resulting in some form of “net” or “residual” risk that is compared to a target level of risk. Often, the identification of risk results in categories of risks, such as bribery, loss of personal data, antitrust, etc.
