Where does the risk function fit with ethics and compliance Areas of convergence Practical implications and examples

Transcription

1 The Convergence of Ethics, Compliance and Risk SCCE Annual Conference 2007 Terry Hancock CEO SAI Global Presentation summary 2 Where does the risk function fit with ethics and compliance Areas of convergence Practical implications and examples 1

2 Where does risk fit? 3 Traditional definition of risk management and its function Risk management is the logical process of weighing the potential costs of risks against the possible benefits of allowing those risks to stand uncontrolled. The risk management process is designed to minimize risks in order to reduce mishaps, preserve assets, and safeguard health and welfare. Generally segmented between strategic, operational, market and industry based (e.g. food or credit) Risk management Goals 4 2

3 How does risk discipline differ from C & E? 5 Focus tends to be on operational issues, capability, effectiveness etc Tends to discount values/principles in favor of events and probabilities often via quantitative techniques Legal (and compliance) risk is only one component in weighing overall risk Allows for degrees of control and emphasis therefore presumes some level of default/risk Generally is not directly concerned with issues of right and wrong Increasingly used to allocate capital both financial, resource and human based Risk, Compliance & Ethics 6 Risk assessments are now normal, well developed and required to inform C & E programs C & E risk assessments focus typically on specific legal risks and conduct categories in the context of overall business activity Risk functions focus mainly on many business processes where problems manifest Controls are usually imposed reflecting the business as a whole not just issues of law or compliance they bridge the credibility gap If ethics are the soul and compliance the body then risk most closely equates to the brain BUT none can exist in isolation 3

4 Risk, Compliance & Ethics 7 Risk is often the absent 3 rd leg of C&E programs Aligned compliance, risk and ethics programs can provide context for one another and can create value for the business. Training and communication programs: a learner-centric approach 8 Ethics awareness programs can seem too esoteric, removed from, or even incompatible with, business objectives Compliance programs can seem bureaucratic and are often associated with sanctions for wrong-doing Risk management can be seen as more pragmatic, focussed on business processes the operational element can appeal to learners 4

5 Training and communication programs: a learner-centric approach 9 What do learners want? A short, engaging, learning experience that is tailored to their own particular circumstances Clear, unambiguous guidance on critical issues Credible and relevant content Training and communication programs: a learner-centric approach 10 What do ethics and compliance officers and risk managers want? Meaningful behavioural change as a result of training interventions Creating a lasting cultural shift in the organisation Enabling risk, compliance and ethical reward decisions in a rapidly changing environment 5

6 Applying risk principles to training and communication programs 11 Provide learners with an accessible conceptual framework that focuses on the connections between compliance, ethics and risk management Emphasise possibilities for value creation as well as for the management for reputational and other risks Tailor content to learners needs and risk profiles Bridge the gap between ethical principles, compliance requirements and their application on a day to day basis Case Study Background 12 Asia Pacific based global financial services organisation Circa 40,000 employees operating in 29 jurisdictions worldwide Some challenges: Creating an effective global compliance risk and ethics program that brought together risk management and compliance frameworks within the context of a broader program of cultural transformation driven by widely publicised ethical values A history of training overkill and fatigue in the target audience with excessive, low quality, one-size fits all compliance ethics and risk training already in circulation Existing material tried to cover everything for everyone - a blunt instrument with either too much or not enough Topics could be prioritised but is a topic based approach enough? How to reconcile who needs what, where and on what basis Considerable internal conflict over priorities and process 6

7 Case Study 1. Creating the conceptual framework 13 Case Study 2. Optimising learner experience and impact through risk-based learning 14 7

8 Applying risk principles to training and communication programs 15 A learner s risk profile can depend on: Jurisdiction Job role Involvement in business processes and transactions Business line Management responsibilities Risk and compliance responsibilities To optimise the learning experience and application of the learning, flexible content should be developed to reflect differing risk profiles Applying risk principles to training and communication programs 16 A foundation module is a collection of flexible learning objects that can be combined according to learners risk profiles Factors in this privacy example include: Business line Job role (e.g. special requirements for HR) Business process (needs of customer facing vs back office staff) Jurisdiction 8

9 Handling jurisdictions 17 Local legislation and regulation impacts a learner s risk profile and training needs Use of flexible learning objects enables relevant legislative and regulatory content to be delivered to learners in different jurisdictions The framework can be common Regulatory updates can be included for accuracy and currency of content Bridging the gap between principle and practice 18 Credible, realistic and relevant case studies, tailored to the learner s risk profile are a key instructional device Apparently unconnected learning points can be woven into a coherent story. Learners spot the issues and determine the appropriate course of action in given situations. An Issue Spotting button or Red Flag can be used by the learner to highlight concerns. Implicit events are turned into explicit learning points 9

10 Beyond training. 19 Increasing focus on more comprehensive web-based risk and compliance solutions. Summary & discussion 20 A risk-based, learner-centric approach will optimise the learning experience and maximise transfer of learning Convergence between risk, compliance and ethics is a positive shift from a learner perspective the divisions are artificial in the eyes of the average employee Corporations are increasingly tackling this challenge and achieving meaningful behavioural change in employees and a lasting cultural shifts in their organisations 10

11 21 Discussion 11