How To Understand And Understand The Risks Of Compliace

Transcription

1 A Valuable Tool to Uderstad ad Maage Your Compliace Risks The Uique Alterative to the Big Four

2 Compliace is icreasigly beig idetified as a key risk withi a orgaizatio s eterprise risk maagemet (ERM) programs. The solutio? A eterprisewide compliace risk assessmet, which provides the board of directors ad maagemet with a strog framework to idetify risks across all compliace activities. A comprehesive approach is more effective ad cost-efficiet, ad ca stregthe corporate goverace.

3 A Valuable Tool to Uderstad ad Maage Your Compliace Risks The curret times might be thought of as a zero-tolerace era for busiess. Crimial charges are beig filed more frequetly tha i the past. Watchig the mighty fall a successful tastemaker like Martha Stewart, a oce-lauded compay such as Ero ever ceases to catch the public s imagiatio. I this climate, eve seemigly iocuous oversights i compliace ca be whipped up by aggressive prosecutors ad the media ito reputatio-damagig crises. The curret ladscape compels compaies to broade their scope beyod arrow ad legalistic approaches to compliace. To meet the expectatios of regulators, a orgaizatio is well-advised to adopt a risk-based framework. A eterprisewide compliace risk assessmet (EWCRA) provides a comprehesive evaluatio of risks withi relevat departmets ad across busiess lies. The beefits iclude improved uderstadig of overall compliace risks by maagemet ad the board of directors, aligmet of risk maagemet activities with risks, ad better moitorig ad reportig of compliace risks, icludig aggregatio of risks across the orgaizatio. EWCRA is a compoet of ERM, both of which ca stregthe corporate goverace. Challeges Regulators, reflectig the mood of the public ad politicias, are less forgivig today. Large fies ad headlies have stug some compaies. But the larger price is less tagible: distractio from achievig strategic objectives such as mergers ad acquisitios. Beig i the regulatory doghouse ca limit growth plas. Whereas compliace used to be relatively cut-ad-dried, regulators ow ask compaies to begi with a thorough risk assessmet. The maagemet team is expected to uderstad the wide rage of regulatory risks affectig the compay, evaluate which parts of the overall busiess are more vulerable to specific risks, ad the devote greater attetio to moitorig ad mitigatig areas of higher risk. Without a well-coordiated approach to compliace, importat risks ca ad will fall through the cracks. Compay executives are realizig the eed for cosistet, acrossthe-board methodologies to evaluate regulatory compliace ad to prioritize risks. The majority of large U.S. compaies have umerous frameworks, models, ad cotrols to assess ad moitor risks. The lack of a cohesive approach hiders a comprehesive view. As a result, chief compliace officers, executives, ad directors lack a uified perspective of whether all sigificat lies of busiess ad affiliate orgaizatios are i compliace with a multitude of regulatios. I geeral, compliace fuctios have ot reached the comparatively sophisticated approach that auditors employ. May iteral audit groups have used a risk-based methodology for a decade or more. A risk-based approach sets priorities ad devotes a larger percetage of moitorig resources where eeds are greater. I cotrast, a siloed approach to compliace results i wasted effort ad ueve quality. Gaps i regulatory compliace are more likely to appear whe cookie-cutter approaches are used to address specific challeges.

4 A Valuable Tool to Uderstad ad Maage Your Compliace Risks Compliace moitorig at may compaies, for example, is t based o risk. I may cases, a compliace employee tests because he or she has systems i place to test. Addressig fuctios that preset greater risk is usually ot part of the job descriptio. The Solutio Compay attoreys ca ad do provide valuable compliace guidace, but the legal team lacks a process orietatio ad techology skills to desig improved risk-based systems. Because the level of regulatory scrutiy has rise, the demad for compliace talet with a risk-based focus has grow. A shortage of seasoed talet leads may compaies to look outside to fill the gaps, ad to help re-egieer regulatory compliace processes. Solutios Settig up a eterprisewide framework to maage compliace risks is oe way to improve use of existig compliace resources. Risk assessmet ca be built ito existig activities, thereby turig ad hoc processes ito collaborative ad sustaiable workflows. The EWCRA framework (Figure 1) offers a comprehesive view of all compliace risks o matter how complex the busiess lies or how far-flug the offices ad employees. The framework ecompasses: Measurig a orgaizatio s risk across all compliace activities; Operatig as a tool to drive cosistecy; Fuctioig as a commo body of kowledge; Aggregatig risks across the etire orgaizatio, ad reportig collectively o risks; ad Providig seior executives with a itegrated approach to prioritize higher ad lower risks to the orgaizatio. Figure 1: EWCRA Framework Risk Maagemet Moitor Residual Risks Uderstad Iformatio ad Commuicatio Ifrastructure Eviromet Iheret Risks Assess Compliace Risk Implemet Respose/Cotrols Plaed Risks Compliace Risk Strategy

5 A Valuable Tool to Uderstad ad Maage Your Compliace Risks The framework is logically part of a larger framework for ERM. A orgaizatio may, for example, use EWCRA as a steppig stoe to develop ERM, or itegrate EWCRA with existig ERM activities. Both EWCRA ad ERM are ogoig processes iteded to stregthe corporate goverace. The EWCRA framework was desiged to reiforce the ERM itegrated model developed for the Committee of Sposorig Orgaizatios of the Treadway Commissio (COSO). While the COSO ERM framework has eight compoets, the EWCRA framework has six key elemets. For more about the COSO ERM model, visit crowechizek.com ad dowload Compliace Overload Drives Iterest i ERM. Here is a closer look at each of the key EWCRA compoets: Step Oe: Uderstad Eviromet Lack of uderstadig ca lead to iefficiet use of limited compliace resources. Uderstadig a orgaizatio s culture requires assessig umerous iteral ad exteral factors. What is the orgaizatio s cultural view of compliace? How does that view affect strategic plaig ad maagemet activities? Aswerig these ad other questios leads to exploratios of the iteractio of EWCRA with orgaizatioal structure, customers, products ad services, techology, ad huma resources. Step Two: Assess Compliace Risk This step allows the maagemet team to idetify evets ad potetial effects o the ability to meet strategic objectives. The extet of ifluece (Figure 2) is measured o perpedicular axes: sigificace ad likelihood. The impact is measured through a combiatio of qualitative ad quatitative methods, ad becomes icreasigly precise as the EWCRA process matures. The assessmet first is performed based o the iheret risks of ocompliace with regulatios (i.e., without cosideratio of the impact of existig cotrols). Startig this way idetifies particular cotrols most likely to esure compliace. The assessmet the ca be performed agai, this time givig cosideratio to the desig ad operatig effectiveess of key cotrols. Reassessmet yields residual risk to the orgaizatio. The hope is that, while iheret risks might be rated high iitially, residual risks are reduced.

6 A Valuable Tool to Uderstad ad Maage Your Compliace Risks Figure 2: Targetig Areas of High Risk Sigificace Low Moderate High Risk Moderate Risk High Risk Very High Risk Low to Moderate Risk Moderate Risk High Risk Low Risk Low to Moderate Risk Moderate Oe goal is to idetify high risks that belog i the top right sectio High Moderate Low Low Moderate High Likelihood Step Three: Compliace Risk Strategy Not all risks icludig compliace risks have equal weight or importace. Oce a risk assessmet is completed, maagemet decides o a strategy to respod with resources appropriate to maage the risk. Basically, there are four broad resposes: avoidace, sharig, reductio, ad acceptace of risk. Each of these strategies results i differig resposes to maagig risk. Because of prohibitive ecoomics, ot every risk ca or should be guarded agaist. Reducig risk to zero probably meas spedig too much, ad reducig, if ot elimiatig, profitability. Thus, the well-kow sayig, o risk, o reward. Step Four: Implemet Respose/Cotrols What is the process that helps esure that maagemet resposes to idividual risks are carried out? Cotrols help make processes more effective by eablig key aspects to cotiue operatig. Maagers eed to balace the cost of cotrols with the beefits to be derived. For example, more critical risks usually require automated ad prevetive cotrols. O the other had, maual or detective cotrols may be used for areas of reduced risk.

7 A Valuable Tool to Uderstad ad Maage Your Compliace Risks Step Five: Moitor Moitorig occurs through evaluatios by idepedet iteral ad third parties (which would iclude testig of actual compliace), self-assessmet, ad maagemet oversight. Additioally, moitorig idetifies deficiecies withi the cotrol eviromet that maagemet eeds to address. Moitorig activities eed to be aliged with level of risk. Step Six: Iformatio ad Commuicatio The fial step raks high i importace to the lastig ad successful implemetatio of the EWCRA process. Corporate reportig provides a big-picture perspective for the ERM program, maagemet, board of directors, ad audit committee. Iformatio ad commuicatio ideally promote the eed to review the EWCRA process cotiually ad make refiemets. The regulatory eviromet is ever static. Tagible, Itagible Beefits Compaies stad to beefit by establishig comprehesive programs to maage compliace across the eterprise. A eterprisewide approach is more likely to keep importat risks from slippig through the cracks. I additio, EWCRA eables compaies to share the laguage of risk assessmet that regulators are adoptig. Havig a flexible ad comprehesive compliace framework eables orgaizatios to aticipate emergig regulatory issues, stay ahead of eforcemet expectatios, ad avoid reputatioal damage. EWCRA ca help compaies avoid fies ad pealties, but the larger gais are itagible. Preservatio ad stregtheig of compay reputatio is a clear advatage for ay orgaizatio, particularly give today s era of miimal tolerace for regulatory ad ethical shortcomigs. Cotact Iformatio: Rick Julie ca be reached at or rjulie@crowechizek.com. Todd Richards ca be reached at or trichards@crowechizek.com.

8 Crowe Chizek ad Compay LLC is a member of Horwath Iteratioal Associatio, a Swiss associatio (Horwath). Each member firm of Horwath is a separate ad idepedet legal etity. Accoutacy services i the state of Califoria are redered by Crowe Chizek ad Compay LLP, which is ot a member of Horwath. This material is for iformatioal purposes oly ad should ot be costrued as fiacial or legal advice. Please seek guidace specific to your orgaizatio from qualified advisers i your jurisdictio Crowe Chizek ad Compay LLC PML6041