The LRN ethics and compliance risk management practices report

2008 DETAILED RESULTS
DEFINE
1. Is your ethics and compliance risk assessment process integrated with other risk
assessment processes within your enterprise
Nearly 9 out of 10 enterprises conduct ethics and compliance risk assessments.
Respondents
Yes 58%
No 19%
Don't know 10%
We do not perform 13%
Ethics & Compliance Risks Integrated with ERM Program
We do not perform
Managers
Function 2008
Compliance 6300%
Legal 6200%
Internal Audit 5900%
Executive Team 5600%
Human Resources 5100%
Board of Directors 4700%
Finance 4400%
Business managers 4100%
Ethics 3900%
IT 3800%
Data Privacy 3400%
Risk Office 2300%
External Auditors 2200%
Consultants 1400%
Managers Involved in Risk Assessments%Respondents
Under 5,000 4200%
Over 10,000 5600%
Top Ethics and Compliance Risks %Respondents
Electronic Data Protection 5200%
Data Privacy 4700%
Intellectual Property 3200%
Environment Health and Intellectual Property 3000%
FCPA and Anti-bribery 2700%
Sexual Harassment 2600%
Export Controls 2300%
Conflicts of interest 2100%
Supply Chain 2000%
Insider Trading 1600%
Frequency of Conducting Risk Assessments Respondents
Annually 144 39%
Periodically as part of audit 90 25%
No formal or set schedule 51 14%
More than once a year 34 9%
I do not know 28 8%
Less than once a year 17 5%
365
Using information from Risk Assessment%Respondents
Share findings 7100%
Rank findings 5100%
Apply findings to programs 4300%
Map findings 3200%
Ethics & Compliance Risks Integrated with ERM Program
Don't know 1000%
Other metrics 300%
We do not perform
Don’t know
No
10%
19%
13%
% Respondents
Only 12% of respondent companies do not perform risk assessments, nearly unchanged
since 2007. The lifecycle Frequency of a comprehensive, of Conducting Risk effective Assessments risk management and mitigation
program must begin with understanding and measuring risks. Integrating the assessment
Less than once a year
with other business processes especially boosts its effectiveness, given that ethics and
I do not know
compliance concerns now filter down into nearly every department and operation of
enterprises. Conducting More holistic than risk 8% assessments 5% in conjunction with financial auditing,
once a year
manufacturing, marketing, sales, 9% IT, and other functions ensures that a more complete range
of risks are identified and correlated to ethics and 40% compliance Annually concerns as necessary.
Disappointing in these No formal results or is the 14% fact that nearly 2 in 10 companies (19%) still do not
integrate their risk assessments
set schedule
with other business processes. Among the potential
explanations of this fact can be: the ethics 25% and compliance function has only recently been
created, a budget shortage, or an industry-specific rationale that precludes the need to integrate.
Periodically as
part of audit
2. What Functions are involved in the Ethics and Compliance Risk Assessment
% Respondents
A wide range of functions may be involved in risk assessments, though four
typically lead the field.
58%
Managers Involved in Risk Assessments
Yes
100%
42%
Under 5,000
employees
Electronic Da
Intelle
Environment Health and Intelle
FCPA an
Sexu
E
Conf
13%
Map risks according to:
% Respondents
Don’t know
Specific employees or groups 2900%
10%
Other metrics 1100%
56%
80%
60%
40%
No
19%
58%
Yes
42%
20%
Using 0% information from Risk Assessment
Ranking findings according to: % Respondents
Probability of occurrence 4400%
Monetary value 2700%
Other metrics 2100%
% Respondents
Under 5,000
employees
Over 100% 10,000
employees
80%
% Respondents
60%
71%
Top Risk Assessment Challenges % Respondents
Inadequate Frequency resources of Conducting Risk Assessments 4700%
Obtaining accurate/ quantifiable info 3500%
Conducting a global assessment 2600%
Analyzing and applying Less the findings than once a year 2000%
Insufficient technology 2000%
No I do significant not know challenges 1200%
Don't know 800%
40%
51%
LRN | 2008 Ethics and Compliance Top Risk Ethics Management and Compliance Practices RisksReport 32% | 23
43%
20%
10%
% Respondents
0%
3%