Making Compliance Risk Evaluations Pay Off for the Long Term
Reaching milestones during the first year or two of an enterprise risk program indicates some level of achievement. Sustaining those achievements over the next decade, however, is what ensures the investments made in risk mitigation initiatives will benefit the organization over the long haul. Sustainability can depend on near-term tactics, such as continuous monitoring and assessment, and making regular improvements based on the information collected.
Evaluating a compliance program on a regular basis feeds a loop of continuous improvement that should serve to strengthen a program as it matures. The mechanics of working through the evaluation phase of a compliance risk program is one of the core topics discussed in a new book Enterprise Compliance: The Risk Intelligent Approach from Deloitte’s Governance, Risk and Compliance Services.
The book offers perspectives on the three major categories of a risk management program—the compliance Environment as well as the Execution and Evaluation phases—and includes important questions boards should be discussing with management and among themselves. This article, the third in the series, takes a closer look at activities considered vital to evaluating the effectiveness of compliance programs.
In theory, senior executives and board members have access to insights drawn from an unprecedented volume of information related to compliance risk—an amount that continues to grow every year. But as parts of the business outside the compliance function have already discovered, more information doesn’t necessarily mean more insight. In fact, more information can introduce more questions, with a critical one being, “how do we evaluate what really matters?” The following activities—risk assessment, measurement of the compliance program’s return on investment (ROI) and monitoring—are all aspects of a compliance program’s evaluation.
1. Risk Assessment
A risk assessment can cover a wide variety of issues, but it can also give management a false sense of confidence, especially with respect to compliance. “Many companies that conduct risk assessments at the business unit level frequently take an overly narrow view of enterprise risk and pay little attention to compliance issues,” says Donna Epps, a partner and U.S. co-leader of Governance and Risk Management at Deloitte Financial Advisory Services LLP in the pages of Enterprise Compliance. “Multiply that scenario by an organization’s individual units and divisions, and it can add up to difficulties across the enterprise,” adds Ms. Epps.
One way to make sure compliance risk is fully considered is to use a risk register, a catalogue of existing and potential risks specific to the organization’s compliance profile. The register eventually can serve as a framework for understanding and prioritizing risk at every level. Asking management and the board general questions about compliance risk can help steer the conversation in the right directions. Consider the following.
- How does the organization know it is assessing the right compliance risks?
- How do assessments match up with the issues management is tracking?
- When was the last time someone within the organization challenged the scope, approach, outcome or results of an assessment?
- How does the compliance risk assessment feed into enterprise risk management assessments? Growth and M&A risk assessments? Internal audits? External audits?
2. Return on Investment: Measuring the Compliance Program
Increasingly, board members and senior executives are asking what they’ve gained from the effort and expense of compliance initiatives and whether the investments are being managed at the enterprise level. There is at least one easy measure of value that can be tracked: Avoidance or reduction of penalties. But a more careful look at the return on investment (ROI) of a compliance program may require a look at other factors, such as establishing and monitoring key performance indicators (KPIs) and key risk indicators (KRIs).
“Avoided or reduced penalties may be the least significant measure of all,” comments Nicole Sandford, partner and national practice leader of Governance Services at Deloitte & Touche LLP. “Conversely, reputational risk may be one of the more substantial threats because companies that fall out of compliance can quickly suffer reputational damage that can take years to repair.”
To determine ROI, estimate how much has been invested and what is being gained. Next, select the KPIs and KRIs to track. As management moves through the exercise, also consider setting parameters around the scope of the organization’s return on compliance initiatives by considering the following questions:
- How have we linked our compliance efforts to safeguarding and building shareholder value, reputation and assets?
- What is the organization doing to balance the requirement of compliance with the cost of complying?
- Which KPIs and KRIs are competitors reporting?
- What could the organization change tomorrow to either reduce the cost of its compliance efforts or increase their value? Can both be accomplished?
Many executives say they are presented with more information than in the past, but may be in no better position to act on it than before. “Business leaders are struggling under the weight of a growing emphasis on analytics and data-driven decisions,” says Robert Biskup, director, Forensic & Dispute Services, Deloitte Financial Advisory Services LLP. “Yet using the data to gain a competitive edge continues to be a challenge.”
To work through the challenge, an organization should use the information to examine the entire range of compliance processes as part of a continuous improvement effort. In that way, the data can help detect emerging trends associated with risk as well as performance indicators that are directly related to compliance. For example, organizations should consider monitoring external data sources such as blogs to better understand compliance issues in specific geographies in which an organization operates.
Unearthing useful information, however, requires probing the organization for answers that may not be readily available. Questions that can help an organization draw out those answers include the following.
- Where is the information coming from? Are HR, risk, compliance, finance and core systems providing information?
- Is the information being interpreted correctly? What other explanations were considered?
- When was the last time the approach to compliance was changed because of something discovered in the data?
- How are we monitoring changes in the business and their impact on compliance risk?
- Enterprise Compliance: The Risk Intelligent Approach
- Building Enterprise Compliance: The Role of the Environment
- Compliance Risk Management: Executing the Program