Compliance &Ethics - Society of Corporate Compliance and Ethics

additional internal controls to ensure appropriatemanagement review of transactionsthat present conflicts, and finally, additionalannual audit procedures to mitigate the riskpresented by a conflict of interest.Personal conflicts of interest, such asthe one illustrated above, are often the mostdifficult types of conflicts to identify. Mostorganizations rely on self-disclosure toidentify these relationships. I maintain thatmost familial relationships are well knownthroughout an organization, because it wasmost likely the recommendation of a familymember already employed by the companythat initiated the consideration of other familymembers for employment. Managementshould approach these familial relationshipswithin a company the same way they addresstypical segregation of duties (SOD) risk.Segregation of dutiesA typical SOD analysis involves the creationof a process matrix with one group of sensitivetransactions across the X axis and anothergroup across the Y axis. The SOD analystwould look for the intersection of the samename across two transactions that are consideredto be too high of a risk to be covered byone individual. In much the same way, the analystcould look for the intersection of employeeswith familial relationships and design proceduralchanges or mitigating controls to reducethe risk of the conflict of interest.There are multiple approaches to mitigatingor eliminating the risk of a conflict ofinterest arising from employee familial relationships.The first step towards that goal is torecognize that these types of conflicts do havea tangible cost to the organization and need tobe assessed as process-level fraud risks. ✵Peter Fazio (peter.fazio@ymail.com) is a Manager in the Advisory Servicespractice of Ernst & Young LLP in New York City.1. Sunita Sah, George Loewenstein, Daylian M. Cain: “The Burdenof Disclosure: Increased Compliance with Distrusted Advice.” December 2011. Available at http://www.econ.upf.edu/docs/seminars/sah.pdf.Don’t forget to earn your CCB CEUs for this issueComplete the Compliance & Ethics Professional CEU quizfor the articles below from this issue:··You’ve identified a corporate risk—what next?by C. J. Rathbun (page 33)··Conflict of interest: It’s not so bad ifI don’t get any benefit out of it. Right?by Peter Fazio (page 71)··Gray areas: When ethics problems arenot exactly black or whiteby Frank C. Bucaro (page 74)To complete the quiz:Visit www.corporatecompliance.org/quiz,log in withyour username and password, select a quiz, and answerthe questions. The online quiz is self-scoring and you willsee your results immediately.You may also fax or mail the completed quiz to CCB:Fax: +1 952 988 0146mail: Compliance Certification Board6500 Barrie Road, Suite 250Minneapolis, MN 55435, United StatesQuestions? Call CCB at +1 952 933 4977 or 888 277 4977.To receive 1.0 non-live Compliance Certification Board (CCB) CEU for the quiz, at least three questions must be answered correctly.Only the first attempt at each quiz will be accepted. Compliance & Ethics Professional quizzes are valid for 12 months, beginning onthe first day of the month of issue. Quizzes received after the expiration date indicated on the quiz will not be accepted.Compliance & Ethics Professional May/June 2013+1 952 933 4977 or 888 277 4977 www.corporatecompliance.org 73