COMPLIANCE RISKS AND
CONTROLS
SPEAKER:
D O T T. FA B I O A C C A R D I
COURSE OF BUSINESS AUDITING
UNIVERSITY OF ROME TOR VERGATA
DECEMBER 2015
1. Compliance Risks
2. Compliance to Internal
Regulations: focus on Code of
Ethics
Highlights
3. Compliance System : the role of
the Compliance Officer
4. Appendix:
1. The Methodology of Risk Assessment– Case study 231
2.Internal Audit’s Role in Anti-Corruption Programs
LUISS Business School - Area Post Laurea
3
1. Compliance Risks
Compliance Risk in Enterprise Risk Management: Definition
1) What is Compliance risk?
Compliance risk is exposure to legal penalties, financial forfeiture and material loss an organization
faces when it fails to act in accordance with industry laws and regulations, internal policies or prescribed
best practices.
C
Operational Example: This product does not O
This risk is closely comply M
interconnected with P
the operational risk, R
L
legal and reputation, Legal Refunding request I
I
so that from one S
follows the other. A
K
N
Reputation Loss of customers C
E
Compliance Risk in Enterprise Risk Management: Characteristics
2) What are the main characteristics of Compliance Risk?
Failure to comply with laws, regulations and procedures is a risk :
reputational
and Image
transversal With
to the strategic
organization implications
High
impact
Consequently it must be managed through an ex ante compliance program
(identification, evaluation, monitoring, reporting)
that will reduce the probability of occurrence
COSO Report I: Focus on the Compliance
According to the COSO Report I, internal control is a process, done by people (from the board of
directors, managers and other workers of the company structure), which aims to provide reasonable
assurance on the achievement of business objectives.
Among the business objectives over the effectiveness and efficiency of operations and the Reliability of
budget Information the COSO Report I identifies as the general category the
COMPLIANCE: intended as compliance with laws and regulations
The Internal Control System consists of five interrelated
components:
1. Control environment
2. Risk assessment
3. Control Activities
4. Information & Communication
5. monitoring
Each of the components must exist and operate in an integrated
way in the different levels of the organization because the
objectives, including compliance, are achieved
ERM: Focus on the Compliance
Enterprise Risk Management is a process set up by the Board of Directors, the Management and other
operators of the corporate structure used for the formulation of strategies across the organization,
designed to identify potential events that may affect the company to manage the risk within the
limits of acceptable risk and to provide reasonable assurance regarding the achievement of
corporate objectives. They have identified four major categories of objectives:
These are general aims in line with the corporate
strategic mission.They are declined and contextualized in the
other three categories of objectives;
operational Effective and efficient use of resources
reporting Reliability of information both internally and
externally
COMPLIANCE Compliance with laws and regulations
The eight components which compose the ERM apply to each category of objective and the company
both as a whole and in the various levels / processes / functions.
The following slides are designed to analyze the size of Compliance in COSO I and ERM, applying the
components of the Framework to the Compliance Risk.
Application of the components of the COSO / ERM to management
of Compliance Risk
ERM COMPONENTS COMPLIANCE PROGRAM
1 – Internal Environment
The control environment forms the essential identity of an organization and Management of Risk Compliance requires the definition of:
determines the ways in which the risk is considered to be tackled. Is the foundation • Codes of Conduct and Ethical Principles;
of the other components of the Enterprise Risk Management; it is affected / • Policy Management;
influenced by factors such as the philosophy of risk management, the level of
• Management Procedures;
acceptable risk, the supervision of the Board, the integrity, ethical values,
competence, the modalities of the delegation of powers and responsibilities,
• Bonus plans (which include compliance objectives);
training staff • Penalty System
2 – Objective Settings
The definition of objectives is a prerequisite for an effective event identification, The main objective of a Compliance Program is to ensure the
risk assessment and risk response. The strategic objectives are the foundation for
compliance of business operations by defining tools and
defining the operational objectives, reporting and compliance. For choosing
targets, it must make sure to align themselves to acceptable risk, fixed by the methodologies for the identification and assessment of compliance
company, which are determined by the levels of risk tolerance risk in support of the internal decision processes
3 – Event Identifications
Management must identify events which may affect the company. If they They have identified three categories of events for Compliance risks:
compromise the achievement of the objectives they represent risks that require 1. Violation of external regulations (mandatory)
evaluation and determination of response measures. If they can have a positive 2. Violation of internal rules (soft law / internal
impact, they represent opportunities to pursue redefining strategies. The events are procedures)
influenced by internal and external factors and their identification involves the 3. Non-compliance / update of internal regulations than
application of structured techniques sorting external / legislative development
Application of the components of the COSO / ERM to management
of Compliance Risk
ERM COMPONENTS COMPLIANCE PROGRAM
4 – Risk Assessment
In a risk assessment of compliance must consider many factors
Risk assessment measures the impact of a potential event on the achievement of
affecting impact and probability, such as: 1. P / L: impact on the
objectives in terms of likelihood and impact, through qualitative and / or
quantitative techniques. The evaluation regards both the individual event budget; 2. Customer: compromised of customer relationships; 3.
categories of potential events interconnected in the various levels of the company. Market: perceived value by stakeholders; 4. Business: impact on
Risks can be assessed in terms of inherent risk (that is independent from the business interruption, interdiction and reduced productivity; 5.
existing control system) and in terms of residual risk, which considers the effects Penalties: administrative charges and penalties; 6. Bureaucracy:
on the probability and / or impact of the risk responses activated the total cost of compliance
5 – Risk Response
Based on the risk assessment, management must select the most appropriate In determining the best strategy to respond to the
responses to the risk (avoiding the risk, reducing it, share it, to accept it). The compliance risk must perform a cost - benefit analysis that
choice depends on several factors: cost / benefit analysis; desired effects on the takes into account the hidden costs mainly of non -
probability / impact; capacity to reduce risk within the limits of tolerance. The risk compliance
mitigation strategy should allow to bring the overall level of residual risk within the
limits of acceptability set by top management.
6 – Control Activities
Control activities are the application of policies and procedures to ensure to the The prevailing treatment is mitigating risk through
management that directives to address the risks that may affect the achievement of
appropriate controls (first, second and third level), staff
the objectives are implemented. Control activities are implemented at all levels of
the organization, and may consist of approvals, authorizations, verifications, training, the formalization of procedures, the provision of
reconciliations, review of operational performance, protection of company assets, specific funds (legal risks)
separation of duties.
Application of the components of the COSO / ERM to management
of Compliance Risk
ERM COMPONENTS COMPLIANCE PROGRAM
7 – Informations and Comunications
The company should identify, collect and disseminate relevant information to There should be an internal information system that allows to
enable everyone to fulfill their responsibilities. They must be implemented promptly intercept non-compliant behavior and report
information systems that deal with both internal and external information for the
them to the parties have the power to put an early
risk management and decision making. There must be effective communications to
correction
flow through the entire organization: top-down (eg. Communication objectives);
bottom-up (reports significant); transversal (ie. management processes); to third
parties.
8 – Monitoring
Monitoring has the function of assessing the presence and operation in time of the The monitoring is mainly competence: i. Compliance Officer who
components of the control and risk management system. Is carried out through is responsible for overseeing the Compliance Risk proactively,
continuous supervision, by the operating management, or through specific testing through the 'identification, assessment, monitoring and reporting on
and evaluation, the scope and frequency depends on the risk assessment and compliance; Internal audit must include the compliance risk in their
effectiveness of continuous oversight. plans and submit to an independent review the Compliance
Do not exist in Italy obligations "mandatory“ of implementation of the Models COSO / ERM. However, the
implementation of a process COSO / ERM allows you to manage in a structured and organic way a series of
regulatory requirements with which companies, especially if listed, you have to compare (eg. Codes of
Conduct, Legislative Decree no. 231/2001 , Legislative Decree no. 261/2005, privacy, Standard ISO, etc.)
Decomposition of Compliance Risk
4) What are the different types it can be decomposed compliance risk?
Nature Category Topic (example)
• Code of ethics
Internal • Policy & Procedures
Regulations • Organizational System
• Authorization system
Corporate
Antitrust
Compliance Laws and Governance Code
Corporate Criminal
Privacy
anticorruption
Liability (eg. 231)
Risk Regulations Information (262)
recycling
Related Parties
Health and safety
• Active and Passive
Legal and Contract
Contractual • Litigation & Claim
contractual
Decomposition of Compliance Risk (continued)
Internal Regulations
Code of ethics Corporate Values
Explains the values and ethical principles which
the Company's employees must base their
Behavioral
Rules of Conduct
conduct to pursue objectives of legitimacy, principles
fairness, transparency and verifiability Methods of
implementation
Policy and Procedures Policies & Guidelines
Constitute the corporate provisions likely to
Policies and
provide the framework for the regulation of Procedures
activities and define the operational modalities Procedures
of reference IT System
Organizational System Org Chart
It defines the hierarchy of the company
positions and responsibilities for the conduct of Segregation of
Carry lines
activities, ensuring balance of power between Duties
who execute, checks and authorizes and absence
Job description
of conflict of interest
Authorization system Delegations and power
of attorney
He attributes powers of internal authorization
and signature / representation towards the
Spending Limits power of attorney
outside in accordance with the organizational
system Profiling Data
Decomposition of Compliance Risk (continued)
Laws and Regulations
Corporate
Criminal
Liability
(231)
Markets
Health and
(TUF/
safety
Consob
(81/2008)
Regulation)
Main
regulations
Corporate
Governance Privacy
Code
Company
Information Antitrust
(262)
Decomposition of Compliance Risk (continued)
Legal and Contractual
Intellectual
property
Formulation
of contracts
that do not
Failure to protect the
meet company
contractual enough
obligations
Litigations /
contractual
claims
Assistance and legal advice, for the acquisition and execution of contracts relating to the
contractual relationship with the customer or with third parties (partners, subcontractors, lenders,
suppliers, insurance companies, etc.), as well as for the management of litigation
