Until recently, many global companies likely felt little need to conduct anti-corruption risk assessments. But that has changed dramatically, due in part, to the OECD’s 2010 good practice anti-corruption standards, which deemed risk assessment to be the foundation for designing all other anti-corruption compliance measures; in part, to a similar emphasis on risk assessment in the UK Ministry of Justice’s guidance regarding adequate compliance procedures under the Bribery Act; and partly, to a much greater emphasis by the US Department of Justice on risk assessment in cases brought recently under the Foreign Corrupt Practices Act.

But while expectations in this area have soared, the understanding of what organizations should actually do to assess anti-corruption risks is best described as uneven. For this reason, I thought that a brief primer on the topic might be of help.

First, too many organizations view anti-corruption risk assessments solely as a means to prioritize audits.   This is inconsistent with the above-described notion of risk assessment being foundational to the compliance program as a whole.  Rather, an effective anti-corruption risk assessment should entail gathering information not only for helping with audits but also for, among other things:

• Designing or revising all relevant policies – e.g., concerning providing gifts, entertainment and travel to government officials/employees of state-owned enterprises; charitable contributions and community support payments; retaining and managing third-party intermediaries; and due diligence in M&A/JV formation/investment.
• Devising anti-corruption training and other communications (including, as appropriate, for third parties).
• Establishing optimal anti-corruption management/governance approaches at various levels of the organization – board, senior management, the ethics/compliance function, finance, HR, logistics, in business units and/or geographies, and among those who manage JV’s.

(Note: this is by no means an exhaustive list.)

Second, given the uses to which anti-corruption risk assessment should be put, it is imperative that organizations identify not only the likelihood and potential impact of a violation (which nearly all assessments do), but also the foreseeable causes of such risks – such as pressures (internal/external); temptations (incentive approaches); culture (not only geographic, but also organizational and possibly industry), among others.  Of course, one source of risk is an inadequate anti-corruption compliance program – and so any risk assessment should include some element of program assessment (and note that independent of the part they play in risk assessments, program assessments are encouraged in the OECD, UK and US standards).

Third, given the need to obtain this sort of “cause” information, conducting interviews should be the principal methodology of assessing corruption risk. Surveys and focus groups can play a part in this, too, but obtaining the type of qualitative information that only interviews can provide is essential to effective risk assessments.

Finally, while some aspects of risk assessment must have an enterprise-wide dimension (e.g., corporate-wide training, the tone at the top), many anti-corruption risks are really “local” in nature.  Note that local for these purposes has not only a geographic element but also many others – e.g., focusing on the potential for corruption in buying and selling specific types of goods and services, weighting risks in specific logistical and administrative functions, among other things.

Welcome to the new and improved IBEI website!  To our long time friends as well as newcomers, we wish everyone welcome and hope that you find the site helpful and beneficial in continuing to provide information and in stimulating dialogue on global business ethics issues.  We welcome your feedback on features you would like to see, as well as topics and issues you think would be useful for us to examine.

For the last two years, the Institute has taken a lower profile in the field to allow us an opportunity to assess both our own organization as well as the landscape of business ethics itself — it’s not just ethics and compliance programs that need periodic assessments!  What we’ve discovered is that while the world of business ethics has become busier than ever, we’re not sure the field has made meaningful progress.  Certainly there continues to a dearth of any real “breakthroughs” or innovations in our industry.  A look at conferences, seminars, publications and websites show that we’re still talking about the same things we were talking about a decade ago.  And in some respects with good reason.  We know that codes, training and ethics offices can all contribute dramatically to improving the ethical culture and climate of an organization.  But fundamental innovations with the capability to propel us into a new era of ethical business conduct remain elusive.

Globally, there is much reason for optimism.  There is more openness and understanding of the important role that business ethics  plays in world commerce.  And there are many companies and organizations doing an excellent job of maintaining truly global ethics and commpliance programs.  But many others continue to put out a “one size fits all” ethics and compliance program that is at best ignored, and at worst, derided as cultural imperialism or corporate window dressing.

So where does this leave the Institute?  Eager to ask probing questions and willing to put difficult issues, even within our industry, squarely on the table. We want to foster innovation by acting as a laboratory for ideas and to contribute to the dialogue about how we can more effectively integrate business ethics into future of commerce and industry worldwide.