Showcasing 7 Elements
Policies, procedures, and standards of conduct should be written in such a way that is easily understood in order to maintain compliance while performing job functions. Policies and procedures should be clearly written, they should be relevant and current, specific to job functions, reviewed on a regular basis and readily available.
Your organization should delegate day-to-day operational responsibility for the compliance and ethics program to specific individual(s) within the organization. Those individuals have to be provided with adequate resources, appropriate authority, and direct access to the governing authority or an appropriate subgroup of the governing authority. Furthermore, organization should have the appropriate high-level personnel overseeing the compliance and ethics function.
Effective training and education can be achieved by offering compliance training frequently (at minimum annually), making training and education part of the job requirements, and staying current on compliance issues and trends by attending conferences, reading articles and/or publications, and professional networking.
Your organization should have assurances that discretionary authority is not delegated to personnel who are likely to act illegally. In order to ensure that, the organization should should performs adequate due diligence activities such are: requesting and checking references, background check, including checking criminal records and sanctioned individuals lists.
Your organization should have policies and procedures in place to effectively enforce the organization’s compliance and ethics program and incentivize its employees to perform in accordance with the compliance and ethics program, including the obligation to report potential irregularities. Standards should be followed by all personnel regardless of position, title, or rank. Never assume the standards are being followed, check in often to inspect for the standards set forth.
Put in place a system and schedule for routine monitoring and auditing of organizational business risks, controls and behaviors. Audits should include a review of the response and resolutions applied during the period, both proactive and reactive. Risk assessment should be performed at least once in two years, and its result should be used for designing future compliance activities and measures.
In order to reduce any identified risks or compliance violations, you should constantly improve your ethics and compliance program. You should address the issue or violation consistently within your program policies and procedures and ensure that this particular risk, issue or violation will not occur in the future and, if it does, implement a control to catch such an issue or violation as early as possible.