The LRN ethics and compliance risk management practices report

EXECUTIVE SUMMARY
Increased global competition, economic downturn and tighter regulation brought greater
pressure on business and with it, greater risk. Both companies and governments worldwide
had to make adjustments to cope with these changes in the business climate. Our 2008 Risk
Management Practices research report shows great awareness of these issues – reporting
substantive progress towards building more stringent programs to manage and mitigate
risks, as tangible steps were taken to develop and nurture a more ethical and compliant
business environment – at all levels of the organization.
Governments around the world strengthen their collaboration to legislate and enforce a
stricter set of rules regulating many facets of business conduct at a global level. The U.S.
and European governments tightened their monitoring of potential anti-bribery and anticorruption
violations. Companies doing business in the U.S. have had to respond to the new
eDiscovery rule that went into effect in 2007, requiring them to account for and maintain all
their internal electronic records including emails, instant messages, and electronic documents
that might prove critical in investigations. New European regulations regarding electronic
data privacy and data protection have affected companies doing business on the continent.
Moving beyond
compliance, more
companies are
conducting culture
assessments.
Faced with this surge of new regulatory compliance demands, as well as fresh ethical
challenges posed by a more complex and global business environment, companies
attempted to make necessary adjustments. 2007 brought with it new challenges to the
business world and important lessons. Scandals like tainted pet food and lead paint in
toys made in China were effective reminders about the need to manage and reduce ethics
and compliance risks, not only within organizations, but also within their networks of
supplier and business partners. The meltdown of the mortgage sub-prime and banking
industries pushed businesses across all industries to re-examine their internal decisionmaking
processes for the types of conflicts of interest and long-term ethical and reputational
risks. This correlates with the increase in companies performing a corporate-wide “cultural
assessment”, indicating that they are moving beyond just compliance into recognizing that
the entire company culture is at stake.
Our research shows that many companies made good progress in managing their ethics and
compliance risks programs by conducting holistic business risk assessments, strengthening
each of the five key steps of enterprise risk management and intensifying executive risk
management training.
Increasingly more companies integrate their ethics and compliance risk assessments into
their enterprise risk management process. Also, the vast majority of organizations have
implemented at least some of the best practices in terms of defining and preventing
risks, detecting violations and responding to them. Organizations with mature ethics and
compliance functions appear to strongly benefit from their prior efforts, having developed
critical experience and skills to assess risks, educate employees, and minimize violations.
Organizations with newer ethics and compliance departments and those with fewer
resources find themselves still with challenges.
LRN | 2008 Ethics and Compliance Risk Management Practices Report | 3