1E9Ct5D

a keener eye on ensuring that risks falling into priority enforcement areas are properlyidentified, evaluated, and tracked. This proactive identification of risks, ongoingreassessment of risks and tailoring of compliance efforts serves to protect againstwhistleblowers and related risks by allowing key risk areas and problems to be identifiedand corrective action taken as necessary to avoid problems before they can ripen intocontroversy.In evaluating compliance programs, we observe the lack of appropriate riskidentification and response to be a factor that significantly hampers companies’ ability tohead off whistleblower and related allegations of misconduct. The troubles befallingmany of these companies relate to risks that were reported but not effectively evaluated,risks that were not understood, or situations where risk was downplayed or discounted.The ability to demonstrate that a company has devoted appropriate effort to thehandling of reported problems and identification of key risks offers huge benefits inconnection with the effort to convince the government that the whistleblower case underreview is not tied to systemic problems or disregard of the law. As the governmentunderstands that no compliance program or company is perfect, well developed recordsreflecting robust internal reporting process, risk identification and compliancemanagement of those risks are critical to success in heading off or resolvingwhistleblower and enforcement matters.D. Making Compliance a Priority“Tone at the Top” and “Culture of Compliance” may be overused phrases but theyremain quite relevant to efforts to encourage internal reporting of problems. In the past,19