Question: What are things I should prioritize when establishing a compliance program without many resources?

Answer:

The Department of Justice in the U.S. and the Serious Fraud Office in the UK have shared guidance on the best ways to ensure that you are not only establishing a strong compliance program, but also evolving your program to meet your compliance needs as your company changes—acquisitions, mergers, joint ventures, and starting new areas of business increase the risk for non-compliance within your organization. One thing that these agencies both stress as a matter of necessity in a successful compliance program is risk-based training. To begin, you can focus your energy on completing an initial company-wide risk assessment. This will give you a sense of where you need to tailor your training. The assessment should help to expose gaps in compliance knowledge, to ensure all employees are aware of the risk scenarios they can be faced with, and how to respond when in those risky situations. As a leader for your compliance message to your company and those representing your company, you must ensure that they receive the proper training for:

• Their role within the company: whether an executive in the C-Suite or an intern, every employee needs to understand how their role can expose them to high-risk scenarios. The training should cover every position to ensure there are no misunderstandings as to expectations, and there should be a clear policy in place to keep employees apprised of their role in ensuring compliance and good governance.

• Their level of expertise: there are going to be some employees who, based on their previous work or their current position, will have more knowledge as to their relationship with high-risk scenarios. TRACE offers competency-based training, using pre-tests to determine knowledge level on a compliance topic to allow those with more knowledge to “test out” of annual required training and meet all learners “where they are.”

• Their risk level: as touched on above, each position within a company can be faced with different scenarios of varying risk. Based on the risk assessment, you will know more about the risk level of each position within your company. From this data, you will be able to tailor and deploy training that caters to the needs of each position and its corresponding risk level.

Training should include additional professional development learning for those who might be exposed to a higher risk. For example, at TRACE International, we offer a higher learning program called TRACEpro through our memberships. This program can be used to supplement the compliance training for those employees who are inherently exposed to more high-risk scenarios and thus need to be armed with the appropriate tools to ensure they are compliant with local laws and company policy.

No matter the size of your compliance team, the importance of risk-based training is clearly a priority, especially to those enforcement agencies who are keeping tabs on international company compliance and good governance. By focusing your initial energy on a company-wide risk assessment, you will be able to tailor your education and training to address those high-risk areas and positions within your institution and better align your company with your compliance initiatives, while saving costs associated with extraneous resources that do not match your company’s compliance goals.