Corporate Compliance, Risk, and Governance Action Plan

Overview of Key Audit Findings

This report presents to the board of WB a brief overview of the key findings from the review undertaken, elucidating the concerns identified in an internal audit. The report then offers a clear explanation of why continuation of existing practices — and the absence of corrective measures — will be risky and detrimental to WB. It also includes an initial plan of action to address the weaknesses identified, in both the short term and long term, along with an explanation of the necessity of the proposed corrective actions, some of which are pre-emptive.

One of the key issues identified in the internal audit was that a number of high-risk investment products, with a suggested minimum investment term of over ten years, were sold to consumers aged in their 80s — a high-risk consumer category. Moreover, such proposals were not communicated to the board of the company before the deals were finalized. Secondly, there is evidence of a poor sales and compliance culture. The investigation revealed a lack of due diligence in the internal audit and in the record-keeping of customer accounts. It was found that there had been minimal oversight of sales activities in relation to high-risk products, either by management within that area or by the Compliance and Assurance team.

WB currently lacks a well-founded compliance culture. An organization's culture dictates the climate that is set, and it encompasses the guiding principles, rules, and regulations followed by personnel. If the culture within an organization does not address compliance issues, the organization is bound to end up in disarray (Kedia et al., 2016). WB must treat compliance as an important part of its strategy and work ethics; ignoring it can lead to poor business decisions, a growing number of dissatisfied clients, and constant regulatory scrutiny — all of which harm reputation and operational efficiency. WB should address these issues urgently, as they are likely to have a damaging effect on most activities within the organization (KPMG, 2008).

In addition, the internal review of operations within the division revealed training weaknesses relating to both the sales team and the Compliance and Assurance team. A lack of employee training is detrimental to the company in the long term, largely because personnel will continue to be ignorant of crucial requirements, leading to a failure to recognize breaches or violations in the conduct of service and sales agreements. Eventually, the company runs the risk of continued transgressions from personnel — even if involuntary and arising from ignorance — which can result in losses for the company.

Furthermore, it was found that there was no compliance, governance, risk, and compliance manual in use within the division. Instead, staff depended upon ad hoc guidance and information, and there was a limited level of reporting and interaction between the branches and the main Compliance and Assurance team. This is a significant concern, as it increases the likelihood of wrongdoing and misconduct. The absence of a compliance manual means that personnel and senior staff alike do not have access to the rules, regulations, and policies they should observe and adhere to (KPMG, 2008).

Board and Senior Management Compliance Responsibilities

It is imperative for every organization to have effective governance, risk, and compliance (GRC) practices embedded into its work culture. GRC describes the manner in which management assesses and safeguards against pertinent risks, monitors and evaluates the efficacy of internal controls, and reacts to and enhances operations based on learned insights. GRC is the integration of all governance, risk assessment and mitigation, and compliance and control activities so that they function in combined effect. A GRC approach can help generate business value by reducing expenditure, identifying operational inadequacies, justifying controls, and facilitating the identification and management of risks (KPMG, 2008).

The board of directors is responsible for overseeing the management of WB's compliance risk. The action plan promulgated by the board begins with the approval of the company's compliance policy, encompassing an official document that establishes a permanent and effective compliance function. Compliance with appropriate laws, rules, and standards should be perceived as a vital means to this end. The board is accountable for ensuring that an appropriate policy is in place to manage the company's compliance risk, and should oversee the execution of the policy while ensuring that senior management addresses compliance problems effectively and expeditiously through the compliance function. The board should undertake at least an annual assessment of the extent to which it effectively manages its compliance risk (KPMG, 2008). The main task of WB's board is putting good governance into practice, and enabling the different departments and branches of the organization to undertake their work in compliance with regulations and strategic objectives — including defining roles, responsibilities, and reporting lines.

The senior management of the firm is accountable for the effective management of its compliance risk. In the short term, senior management should establish a written compliance policy that encompasses the basic principles to be followed by both management and staff, and that elucidates the key procedures for recognizing and managing compliance risks at all levels of the organization. Clarity and transparency may be achieved by distinguishing between overall standards applicable to all members of staff and rules applicable only to particular groups (KPMG, 2008).

Another responsibility of WB's senior management is to ensure that the compliance policy accounts for appropriate remedial or disciplinary action in the event of any breaches. With the help of the compliance function, senior management should annually identify and evaluate key compliance risks facing WB and the strategies for mitigating them. Such strategies should address shortcomings in the management of existing compliance risks, and identify any supplementary policies or processes needed to counter new compliance risks identified through the annual risk assessment. Senior management should also report any material compliance failures to the board of directors in a timely manner (KPMG, 2008).

Compliance Manual and Program

Part of the action plan is for the company to establish and implement a compliance manual or program. In essence, the compliance manual delineates the basic principles that must be observed and adhered to by all senior management and personnel. In addition to establishing the compliance manual, WB should ensure that it follows the program along with the laws, regulations, and rules associated with its business operations. This should be undertaken with the main purpose of ensuring that the company develops an even more ethical corporate culture that is consistent and sincere, regardless of personnel level or work title. In order for the compliance manual to be effective, it should include eight distinctive elements (Wulf, 2011).

First, WB must have senior company employees who undertake effective oversight and have the authority to report directly to the governing entity, such as the Audit Committee. Second, the program should include written policies and procedures — internal controls and standards of conduct that are reasonably capable of reducing the probability of misconduct, integrated into a written code of conduct that facilitates audit systems and other processes to have a practical likelihood of preventing and detecting wrongdoing (Compliance 360, 2016).

The third element is training and education. The compliance program should encompass informing personnel through education and training — not only about prevailing regulations and policies, but also about new and revised ones. The fourth element encompasses lines of communication. WB must take effective steps to communicate periodically and in a practical manner its standards and processes, and other elements of the compliance and ethics programs throughout the organization, including to senior management and the board of directors. In particular, WB should have a system of record within its compliance infrastructure that facilitates not only the management but also the communication of information about regulatory changes, and that creates automated alerts to ensure those responsible for implementation are informed of the latest updates (Compliance 360, 2016).

Standards should also be implemented through disciplinary guidelines that are well publicized. The program should encompass internal compliance monitoring, responses to recognized transgressions, corrective action plans, and risk assessments undertaken on a periodic basis. In general, WB should reward actions that exhibit observance of an ethical culture and penalize or warn individuals who fail to comply with the company's ethical standards. The compliance manual and program should also include guidelines that require WB to undertake appropriate investigative actions in response to alleged violations of compliance and ethics codes, and to take fitting measures to safeguard the privacy of investigations (Wulf, 2011).

Conclusion

The measures and recommended actions detailed above are significant for WB to resolve the problems observed in the findings from the review undertaken. It is vital for every organization to have effective governance, risk, and compliance. These aspects form a continuous process ingrained into the principles and practices of an organization, depicting the manner in which management identifies and takes precautions against relevant risks, monitors and evaluates the efficacy of internal controls, and responds to and enhances operations based on learned insights (Compliance 360, 2016).

The board of directors of WB should increase its level of oversight, as it bears responsibility for overseeing the company's compliance risk. The action plan for senior management is to establish and deliver a compliance policy, ensure it is adhered to, and report to the board on the management of WB's compliance risk. Executives of WB should ensure observance of the compliance policy and undertake necessary disciplinary action when violations are observed. The board should also put in place a compliance manual and program as part of a compliance management system. This will help employees understand their compliance roles and responsibilities, ensure that such requirements are integrated into business procedures, and allow operations to be assessed to confirm that responsibilities are fulfilled and requirements are met (FDIC, 2012). The manual will also enable personnel to cease depending on ad hoc guidance.

In addition, WB should implement compliance training for all employees — from the board to frontline staff — so that all are educated and knowledgeable in the pertinent laws, rules, and regulations affecting the company. In conclusion, the board has a key and significant role to play in ensuring that these issues are addressed. As leaders within the organization, board members bear the vital responsibility of setting the cultural climate of the company. Personnel follow the standards and policies set by organizational leaders. The board must increase its level of oversight and demand better administration from senior executives.

References

Compliance 360. (2016). White paper: The seven elements of an effective compliance and ethics program. Retrieved 1 September 2016 from http://compliance360.com/downloads/case/Seven_Elements_of_Effective_Compliance_Programs.pdf

FDIC. (2012). Compliance management system. Retrieved 3 September 2016 from https://www.fdic.gov/regulations/resources/director/college/ny/materials/2012-Compliance.pdf

Kedia, S., Luo, S., & Rajgopal, S. (2016). Culture of weak compliance and financial reporting risk. Unpublished manuscript (January 2016).

KPMG. (2008). Governance, risk, and compliance: Driving value through controls monitoring. Retrieved 3 September 2016 from

McDermott, E. (2014). Four ways to fix a broken company culture. WebPT. Retrieved 3 September 2016 from https://www.webpt.com/blog/post/four-ways-fix-broken-company-culture

Temenos. (2015). The importance of compliance training. Retrieved 3 September 2016 from

Volkov, M. (2014). Fixing a company's ethics and compliance culture. Corporate Compliance Insights.

Wulf, K. (2011). Ethics and compliance programs in multinational organizations. Springer.