The LRN ethics and compliance risk management practices report

KEY FINDINGS
To address these concerns, companies need to develop comprehensive privacy and security
policies; conduct audits of their data practices including Internet activities, cross-marketing
and data sharing with affiliates and partners; manage their internal data usage, such as
handling of customer and employee personal data; and educate employees to prevent
breaches or losses related to data privacy.
A majority of companies perform formal risk assessments involving multiple
functions
Respondents are taking risk assessment seriously, with nearly 9 in 10 respondents indicating
they perform risk assessments regularly. Slightly more than half say they integrate ethics and
compliance concerns into other business assessments. Results indicate that depending on
the nature of the risk, companies are utilizing one or more of the following departments in
their risk assessments:
• compliance,
• legal,
• internal audit, and
• human resources.
Most importantly, two-thirds of respondents share the findings of the risk assessments with
their Board and their senior executives, ensuring that top leadership participates in the
responsibility for building ethical and law-abiding business conduct. Furthermore, almost
one-quarter also share their findings with employees, thereby reinforcing ethical awareness
and demonstrating the company’s commitment to fostering an ethical workplace.
Only 4 in 10 respondent companies involve their business managers in the risk assessment
process. The middle managements’ proximity to operations enable them not only to have
a more in-depth knowledge about where the ethics and compliance challenges may lie
but also to gain the subordinates trust and become the channel of choice when reporting
a potential violation. Not tapping into these two key advantages of middle management
creates a critical gap in the risk assessment and detection processes. Furthermore, the survey
results indicate that nearly all companies want supervisors to be a channel for employees to
report violations, it is counterproductive to not involve them in the risk assessment process.
Companies would benefit significantly by proactively including managers in every step of
the risk management cycle and could substantially improve employees’ willingness to report
violations to managers.
Companies cite engaging employees and making education more relevant as their
top challenges in prevention
In terms of preventing risk, respondents point to a lack of resources as their leading
challenge, with nearly 6 in 10 companies marking it. However, beyond this perennial
problem, the next two leading challenges reflect crucial factors that make or break getting
employees motivated to take risk management personally: relevancy and engagement.
More than 4 in 10 respondents indicate making the education relevant is their next most
significant challenge, and one-quarter cited engaging employees.
The search for relevancy and engagement is critical in risk prevention. The learning theory
states that adults pay less attention to information that does not directly affect their
jobs than they do to information that has an immediate value to their day-to-day work.
Numerous studies have also shown that engaging people in their learning boosts their
interest in and ability to use the knowledge. Learning resources that allow people to control
their own progress, interact with the materials, and gauge their learning through self-tests
have proven to have higher impact on adults than one-dimensional lessons that workers
passively read or listen to.
LRN | 2008 Ethics and Compliance Risk Management Practices Report | 7