GRC Journal - (Page 30) BELIEVE Governance, Risk & Compliance follow. For example, a repeated violation of a particular regulation may result in a greatly enhanced fine or a shift from civil to criminal prosecution. Failure to act promptly to address a product failure may lead to prosecution, class actions, and loss of reputation and brand value. To truly “rank” the risks, your analysis must be objective so that priorities are not drastically skewed into the “highest” category. Priority should be based on objective factors that include, but are not limited to: significant risk of enforcement action; potential for irreversible harm to persons or the environment; likely impact on entity operations or finances; and potential for negative publicity. EFFECTIVENESS OF CURRENT CONTROLS Unless you truly are starting a new program from scratch, you most likely have some controls already in place to address compliance and ethical risks. There are two types: a) Preventive: To prevent, reduce, or mitigate risks within the business. b) Detective: To identify and trigger a desired response to risks once they have occurred within the business. Controls that were put in place without a true risk assessment performed beforehand may not be appropriate or adequate to address the real risks you face. You must assess the effectiveness of the current controls – the policies, procedures, internal disclosure structures, monitoring and evaluations – to ascertain whether they actually do address the risks of greatest concern. Appropriate controls may be non-existent, too limited in scope, or even appropriately designed but not adequately implemented. You must figure out what needs improvement or change, and it is equally important to re-evaluate controls after a risk event takes place – does the design of the controls still match the needs of the organization then? VALUE OPPORTUNITY Where there is cost, there is also opportunity. First, consider the value of changes to controls suggested by the risk assessment, defining value as the incremental benefit received in return for the required investment or cost. But also consider the potential value beyond the implementation of more effective prevention of risk. For example, when a manufacturing operation finds that it can reduce the risk of liability for improper disposal of hazardous waste by replacing a chemical with a nonhazardous alternative, it may also discover that it has reduced waste disposal and operating costs. Or, if it can recycle or reclaim materials, it may even develop a revenue stream. EFFECTIVE STRATEGIC PLAN Going from “what to do” to “how to do it” is a critical step. Without a clear map, you cannot ensure that you will have appropriate resources to achieve your objectives while proactively addressing resistance to change. You need an effective strategic plan. The strategic plan presents the business case for developing and operating a fully integrated program to address the risks you have identified and prioritized. With a well-developed strategic plan, you can help ensure that management’s direction is set forth with a sufficient level of clarity and detail to guide the activities of the program and to ensure sensible investment that is aligned with the overall business model. The strategic plan should identify initiatives and deliverables to be produced, tasks to be performed, when those tasks should be performed, and who should perform them. If you include defined milestone dates with appropriate progress reports, and measurable objectives, you will be able to evaluate the implementation of the plan and its responsiveness to the risk assessment. STRUCTURE LEADS TO SUCCESS A structured approach to risk assessment culminates in a strategic plan, and then provides the framework for ensuring compliance with a vast array of legal requirements and deterrence of unethical conduct. These are achievable goals that will help drive your company to stronger performance. BELIEVE and you will succeed. Carole Stern Switzer is the EVP and General Counsel of the Open Compliance and Ethics Group (OCEG). She has served in that position since 2003. Prior to this, Carole maintained an active national environmental law practice for 20 years, with emphasis on environmental and worker safety compliance, hazardous waste, and contaminated site remediation. She has authored numerous articles and books addressing environmental regulatory compliance and requirements. 4 BTQ Business Trends Quarterly Q1 2007 | www.btquarterly.com http://www.btquarterly.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.