The key purpose served by effective confidential employee reporting structures is, by and large, the same as the key purpose of good governance in general:

In addition to Sarbanes-Oxley, there are a number of laws that stipulate requirements for hotlines.

Read the rest of this entry »

Part 2

A second feature of effective C&E risk assessments concerns the nature of the information that one seeks through the process. That is, while a traditional risk assessment generally attempts to develop information about risk impact, information about the causes of risks may in fact be more useful. (Risk likelihood information is a focus of both traditional risk assessments and what I am calling in this series effective risk assessments.)

Of course, knowing about impact is still important. But unlike risk likelihood - where a broad data gathering effort may be necessary to gain a real understanding - generally the law department is a sufficient source of information on impact. For instance, one doesn’t need to conduct a survey or a lot of interviews to know that the impact of a competition law violation could be high.

Read the rest of this entry »

The 2004 revisions to the Corporate Sentencing Guidelines codified what was already well known to C&E practitioners: that risk assessment should be the foundation of an effective C&E program.

But what exactly should a C&E risk assessment entail? In this series of postings, I’ll explore what I believe are ten features of effective risk assessment, which are:

Read the rest of this entry »