In order for the compliance system to be effective and provide adequate protection, all the steps necessary for its implementation must be carried out, i.e.: a comprehensive audit, an assessment of risk areas, the introduction of detailed procedures covering key risk areas, supervision and control of compliance with the procedures, as well as staff training, as discussed in the previous article: “Compliance – part II – compliance system”. 

This article focuses on risk assessment. Assessment of risk present in an organisation depends on the organisation’s individual needs and circumstances Conducting risk assessment is necessary to develop best possible preventive measures and risk monitoring procedures.

Undoubtedly, the process of introducing of a compliance system must also be well planned. This means that a risk assessment is a key element of this process, as it is intended to prepare the basis for further steps of the compliance system implementation. At this stage a plan is created that defines what actions need to be taken in order to minimise the risk or its consequences, should they occur.

How to properly carry out a risk assessment? Risk assessment takes several steps. The first step is to identify risks. At this stage, the regulations and standards applicable to the organisation and the areas at risk of irregularities in the organisation are identified.  That provides us with information about the risks present in the organisation and their potential impacts. The next step is to assess the impact of the risks present on the organisation. The more risk-prone areas (in the organisation) are identified at this stage, the easier it is to establish tools that will prevent any future damage. The analysis includes in particular: legal, image-related, business, environmental and operational risks.

Based on the identification and assessment of the risks present in the organisation, an action plan is developed, which includes, in particular, the following elements: development of methodologies and procedures for effective risk management, selection of an appropriate tool to support the risk management process and to ensure an appropriate response to risk, ongoing monitoring of the risk management solutions applicable in the organisation for their effectiveness and adequacy to market practices, construction of risk reporting and monitoring mechanisms, educational activities. Effective implementation of the prepared plan is of key importance here, as the effectiveness of the entire compliance system will largely depend on this.

Please read our other articles on compliance:

Compliance – part IV – Compliance officer

Compliance – part III – Who is affected by the compliance system and how it is implemented.

Compliance – part II – compliance system

Compliance – part I – introduction