Conduct risk is the risk that an organization’s behavior toward its customers, counterparties or the markets it operates in causes harm, damages trust or breaks the expectations of fair dealing, whether or not a law or rule was broken. It is the risk of doing legal things badly. A bank that sells a customer a product that is permitted but unsuitable, an insurer whose claims process is compliant but designed to exhaust the claimant, a retailer whose subscription is lawful but built to be hard to cancel, a sales force whose incentives make mis-selling rational: none of these may be compliance failures, and all of them are conduct failures. The term was born in United Kingdom financial services regulation in the early 2010s, after a decade of mis-selling scandals that compliance programs had not prevented, and it has spread because the problem it names exists everywhere incentives, products and customers meet.
This guide defines conduct risk and separates it from compliance risk, which it is constantly confused with; traces where the concept came from and how regulators in the UK, the United States and Australia now treat it; explains the four mechanisms that produce conduct failures; gives the indicators that reveal them early; sets out a conduct risk audit program with tests and evidence; shows how to write conduct findings, which are harder than control findings because the condition is a pattern rather than a breach; and ends with a worked example of a regional bank auditing its retail sales incentive program. It sits in the site’s Risk Library beside the compliance risk guide and the culture audit method.
In this guide
- A working definition
- Conduct risk versus compliance risk
- Where the term came from, and how regulators treat it now
- The four mechanisms that produce conduct failures
- Examples across sectors
- Incentive design: the root cause that keeps recurring
- The culture link
- Conduct indicators: the metrics that show it early
- What a conduct risk framework contains
- A conduct risk audit program
- Writing conduct findings
- Conduct risk outside financial services
- Template: the conduct risk assessment record
- Worked example: Lakeshore Bancorp audits its retail sales incentives
- Questions about conduct risk
- Related guides
A working definition
Regulators have deliberately avoided a single legal definition, on the ground that a definition becomes a checklist and a checklist is what conduct risk escapes. A working definition that serves an audit function: conduct risk is the risk of harm to customers, counterparties, markets or the organization itself arising from the organization’s own behavior, decisions, products, culture or incentives, including behavior that complies with the rules. Three features of the definition carry the weight. The harm is the test, not the rule. The source is the organization’s own choices, which distinguishes conduct from external events. And “including behavior that complies” is what separates it from compliance: conduct risk is what is left over when the compliance program has done its job.
| Element of the definition | What it means | Example |
|---|---|---|
| Harm as the test | The question is whether someone was treated unfairly or damaged, not whether a rule was broken | A fee that is disclosed in the terms but set at a level that makes the product bad value |
| The organization’s own behavior | Products, pricing, sales practices, claims handling, information given or withheld, the design of processes customers must use | A cancellation process that requires a phone call during working hours |
| Customers, counterparties, markets | Retail customers are the usual focus; wholesale conduct covers counterparties and market integrity (benchmark manipulation, front-running) | A trading desk’s handling of client orders |
| Including compliant behavior | Conformance with rules is necessary, not sufficient | A suitable product sold with a disclosure the customer could not have understood |
| Harm to the organization itself | Fines, remediation, reputational loss, license restrictions follow the customer harm | A multi-year remediation program and an asset cap |
Conduct risk versus compliance risk
The two overlap and are not the same, and a function that treats conduct as a compliance subcategory will miss most of it. The compliance risk guide and the compliance vs compliance risk explainer define the compliance side; the table draws the line.
| Dimension | Compliance risk | Conduct risk |
|---|---|---|
| Reference point | Laws, regulations, rules, internal policies | Outcomes for customers, counterparties and markets; expectations of fair dealing |
| Question asked | Did we follow the rule? | Did our behavior cause harm or unfair outcomes? |
| Can it be breached while compliant? | No, by definition | Yes; that is the point of the concept |
| Typical owner | Compliance function (second line) | The business (first line), with conduct oversight in risk or compliance |
| Typical evidence | Breach logs, regulatory correspondence, policy attestations | Complaints patterns, customer outcome testing, sales anomalies, product reviews, incentive analysis |
| Typical control | Rule mapping, monitoring, training, approvals | Product governance, incentive design, outcome testing, culture measures |
| Classic failure | A regulatory return filed late | Mis-selling of a product that was approved, disclosed and legal |
Where the term came from, and how regulators treat it now
The vocabulary comes from the UK. After the payment protection insurance mis-selling scandal, interest rate hedging product sales to small businesses, and the benchmark manipulation cases, the Financial Conduct Authority, created in 2013, adopted “conduct risk” as the organizing idea of its supervision: firms were expected to identify the conduct risks in their own business models and show how they managed them, rather than wait for a rule to be written. The FCA’s five conduct questions program for wholesale banks, launched in 2015, asked firms how they identified conduct risk, who was responsible, what support staff had, how the board oversaw it, and whether the business model created conduct risk; its annual reports became the template many firms used. The Senior Managers and Certification Regime, applied to banks from 2016 and extended across regulated firms in 2019, attached personal accountability. The Consumer Duty, set out in 2022 and in force for open products from 31 July 2023 and closed products from 31 July 2024, raised the bar from treating customers fairly to delivering good outcomes across four areas: products and services, price and value, consumer understanding and consumer support.
Other jurisdictions reached the same place by different routes. In the United States the term is used less, but the substance is enforced through the Consumer Financial Protection Bureau’s authority over unfair, deceptive or abusive acts or practices and through the banking agencies’ supervision of sales practices, which intensified after the 2016 unauthorized accounts case at a large bank: $185 million in penalties that year, a $3 billion resolution with the Department of Justice and the Securities and Exchange Commission in 2020, and a growth restriction imposed by the Federal Reserve in 2018 that lasted into 2025. In Australia the 2019 final report of the Royal Commission into misconduct in financial services, and the prudential regulator’s 2018 inquiry into the governance and culture of the country’s largest bank, made conduct and culture a board-level matter. The Financial Stability Board’s 2018 toolkit on governance frameworks to mitigate misconduct risk gave supervisors internationally a common vocabulary. The what regulators expect guide covers how examiners now test conduct in practice; the UK regulatory compliance guide covers the UK regime.
The four mechanisms that produce conduct failures
Conduct failures look varied and come from four sources. Knowing which one is operating tells the auditor where to test and tells management what to fix.
| Mechanism | How it produces harm | What it looks like | Where to test |
|---|---|---|---|
| Incentive design | People do what they are paid to do; if pay rewards volume without regard to suitability, unsuitable sales follow | Quotas, cliff-edge bonuses, cross-sell targets, league tables, threats of dismissal for missing targets | Compensation plans; sales data clustered around thresholds; attrition in sales roles |
| Product design and pricing | A product whose value depends on customers not using it, not understanding it or not leaving it | Add-on insurance with low claims ratios; fees that exploit inertia; teaser rates with punitive reversions | Product governance records; claims and usage ratios; price-versus-value analysis |
| Information asymmetry | Customers cannot assess what they are buying; the organization knows and does not help | Disclosures written to be compliant rather than understood; complex products sold to unsophisticated buyers; omitted risks | Communications testing; suitability records; complaints about understanding |
| Culture and tone | What is rewarded, tolerated and talked about; whether staff can raise concerns | “Hit the number” messaging; retaliation; conduct breaches by top performers tolerated | Surveys; speak-up data; how breaches by high performers were handled (culture audit) |
Examples across sectors
| Sector | Conduct failure | Why it was conduct, not (only) compliance | Mechanism |
|---|---|---|---|
| Retail banking | Accounts opened or products added without customer consent to hit sales targets | Individual acts were breaches; the pattern was a conduct failure driven by the incentive system | Incentives, culture |
| Insurance | Add-on cover sold at point of sale with claims ratios in the low single digits | Legal, disclosed and almost worthless to the buyer | Product design |
| Lending | Loans extended to customers who could not afford them, with affordability assessed to the letter of the rule | Compliant assessment; harmful outcome | Incentives, information asymmetry |
| Wealth management | Clients placed in products carrying higher fees to the firm when equivalent lower-fee products were available | Suitability satisfied; best interest not | Incentives, product design |
| Wholesale markets | Benchmark submissions shaded to benefit trading positions | Market integrity harm; later criminalized | Incentives, culture |
| Telecoms and subscriptions | Easy sign-up, cancellation by phone only, retention scripts designed to exhaust | Lawful in many jurisdictions until specifically regulated | Product design |
| Healthcare | Billing codes chosen for reimbursement rather than accuracy; unnecessary procedures under volume incentives | Often also a compliance breach, but the driver is incentive design (hospital revenue cycle) | Incentives |
| Software and platforms | Default settings that maximize data collection; interface patterns that steer users against their interest | Lawful until privacy and consumer rules caught up | Product design, information asymmetry |
| Utilities | Customers left on expensive default tariffs for years | Permitted; harmful; eventually price-capped | Product design (inertia) |
Incentive design: the root cause that keeps recurring
Almost every large conduct failure, examined afterward, traces to an incentive scheme that made the harmful behavior rational for the people performing it. The auditor’s test is therefore not “did staff behave badly” but “what did the scheme pay for, and what did it leave out”. Five features of an incentive plan predict conduct problems: volume or revenue targets with no quality gate (suitability, persistency, complaints); cliff edges, where a threshold triggers a large payment so that the last sale of the quarter is worth far more than the first; relative targets and league tables, which turn colleagues into competitors and normalize corner-cutting at the top; targets set from above without reference to what the territory can honestly produce; and consequences for missing targets (dismissal, demotion, public ranking) that outweigh the consequences of getting caught. The fraud red flags library includes the sales-anomaly flags, and the payroll analytics catalog includes the compensation tests, because the data signatures of incentive-driven conduct (clustering at thresholds, quarter-end spikes, reversals after bonus dates) are the same as the signatures of incentive-driven fraud.
The culture link
Culture is the mechanism that decides whether the other three are caught. A product with a bad claims ratio is noticed by someone; whether that person says so, and whether anything happens when they do, is culture. The IIA’s Organizational Behavior Topical Requirement, effective 15 December 2026, makes culture a mandatory assessment subject when it is in scope, and the site’s conformance workbook for it and the culture audit method give the tests. For conduct specifically, three cultural tests matter: how breaches by top performers were handled compared with breaches by average performers; whether the speak-up channel has ever produced a conduct case that changed a product or a plan; and what middle managers say privately about targets. The last is only available through interviews conducted with care, which the interview techniques guide covers.
Conduct indicators: the metrics that show it early
Conduct risk has data signatures, and a function that monitors them finds problems years before a regulator does. The indicators below are the ones that have proven predictive; each should have a threshold and an owner, as the KRI guide sets out, and each is also a test the auditor can run across a full population.
| Indicator | What it reveals | Signal of a problem | Data source |
|---|---|---|---|
| Complaints per 1,000 customers, by product and root cause | Where customers are being harmed | Rising trend; concentration in one product, channel or team; “did not understand” and “did not ask for” root causes | Complaints system |
| Complaint upheld rate, internal versus ombudsman | Whether the organization’s own handling is fair | Low internal uphold rate with high ombudsman overturn rate | Complaints system; ombudsman data |
| Early cancellation and lapse rates | Products sold that customers did not want | Cancellations within the cooling-off period above peers; lapse spikes after the first premium | Policy and account systems |
| Sales clustering at incentive thresholds | Incentive-driven selling | Volume in the last three days of a period several times the daily average; sales just above threshold | Sales ledger with dates and seller IDs |
| Product claims ratio or usage rate | Whether the product delivers value | Claims ratios below 10 to 15 percent on add-on insurance; features never used | Claims and usage data |
| Customer outcome testing results | Whether customers got what they should | Call listening and file reviews finding unsuitable advice above a tolerance | Quality assurance samples |
| Staff attrition and absence in sales roles | Pressure | Attrition well above the organization’s average; exit interview themes | HR |
| Speak-up reports and outcomes | Whether concerns surface | Zero conduct reports in a large sales force; reports with no outcomes | Whistleblowing channel |
| Breach consequence consistency | Culture | Top performers’ breaches resolved with warnings; others dismissed | Conduct and disciplinary records |
| Vulnerable customer outcomes | Whether the harm is concentrated among those least able to bear it | Products sold to flagged vulnerable customers above the population rate | Customer flags; sales data |
What a conduct risk framework contains
An organization that takes conduct seriously has a framework with recognizable parts, and the audit’s first task is to see which exist. Most sit inside the operational or compliance risk framework rather than standing alone, which is fine as long as the parts are present; the third-party program extends several of them to outsourced sales and servicing.
| Component | What good looks like | Common gap |
|---|---|---|
| Conduct risk appetite and definition | A board-approved statement of the conduct outcomes the organization will not accept, with measurable tolerances (appetite guide) | A values statement with no measures |
| Conduct risk assessment | Each business line identifies its own conduct risks from its products, customers, channels and incentives; refreshed annually | Conduct assessed only as compliance with rules |
| Product governance | New and existing products reviewed for target market, value, understanding and support; products withdrawn when value fails | Approval at launch; no review of in-force products |
| Incentive and performance management review | Compensation plans reviewed for conduct features before approval; quality gates on variable pay | HR designs incentives; risk never sees them |
| Outcome testing | Call listening, file reviews, mystery shopping, customer research on understanding | Quality assurance checks the script, not the outcome |
| Conduct indicators and reporting | The indicators above, with thresholds, reported to the board | Complaints counted, not analyzed |
| Consequence management | Conduct breaches affect pay and promotion consistently, documented | Consequences vary with performance |
| Remediation | Harm identified is quantified and repaid, with root cause fixed | Complaints settled individually; the product unchanged |
A conduct risk audit program
The program below is for a conduct audit of one business line (a retail product set, a sales channel, a claims operation). Framework-level tests come first; the behavioral tests, which are what distinguish a conduct audit, follow. Each row follows the work program form.
| # | Test | Procedure | Evidence | Deviation |
|---|---|---|---|---|
| 1 | Appetite and assessment | Inspect the conduct appetite and the business line’s conduct risk assessment | Statements, assessments, minutes | No measurable tolerances; risks listed as rules |
| 2 | Product governance | Sample five products for target-market definition, value assessment and in-force review | Product files, review records | No value assessment; no in-force review |
| 3 | Incentive plan review | Obtain all variable-pay plans for the line; assess for the five conduct features; confirm risk or compliance reviewed them | Plans, approval records | Volume-only targets; cliff edges; no review |
| 4 | Sales pattern analytics | Full-population analysis of sales by seller, date and product: period-end clustering, threshold clustering, reversals after bonus dates, products added without a customer-initiated contact | Sales ledger, incentive calendar | Clustering significantly above the daily average; reversals concentrated among top earners |
| 5 | Complaints analysis | Full-population analysis of complaints by product, team and root cause; internal versus ombudsman outcomes; time to resolve | Complaints system | Root causes pointing to design or sales; low uphold rate with high external overturn |
| 6 | Customer outcome testing | Sample 40 sales or claims for suitability, understanding and fair treatment: listen to calls, read files, re-perform the affordability or suitability assessment | Call recordings, files | Unsuitable outcomes above the organization’s own tolerance |
| 7 | Early cancellation and lapse | Analyze cancellations within cooling-off periods and early lapses by seller and product | Policy or account data | Concentration by seller; rates above peers |
| 8 | Vulnerable customers | Compare sales to flagged vulnerable customers with the population; test the support provided | Customer flags, sales, contact records | Over-representation; no tailored support |
| 9 | Consequence consistency | Sample 20 conduct breaches; compare outcomes against performance ranking | Disciplinary and performance records | Outcomes correlate with performance, not severity |
| 10 | Speak-up effectiveness | Inspect conduct-related reports and their outcomes; interview a sample of staff about raising concerns | Whistleblowing records, interview notes | No reports or no outcomes; staff describe retaliation |
| 11 | Remediation | For harm identified in the period, confirm quantification, repayment and root-cause fix | Remediation files | Individual settlements without product or incentive change |
| 12 | Board reporting | Inspect a year of conduct reporting for indicators, thresholds and decisions | Board papers, minutes | Complaint counts only; no decisions traceable |
Writing conduct findings
Conduct findings are harder to write than control findings because the condition is usually a pattern, the criteria are often principles rather than rules, and the cause is a design choice someone senior made. Three disciplines help. State the pattern with its numbers and its comparison: “sales in the last three days of each quarter averaged 3.1 times the daily average across the year, and 61 percent of early cancellations traced to those days”, not “there is evidence of pressure selling”. Name the criterion honestly: the organization’s own conduct appetite, the regulator’s outcome expectations, or the product’s stated purpose, and say which. And locate the cause in the design rather than the people: “the plan paid a 40 percent uplift for crossing the quarterly threshold and contained no suitability gate” is a cause management can fix; “sales staff cut corners” is not. The cause statements and impact guides cover the craft; the severity matrix applies with one adjustment: customer harm scales the impact, and a pattern affecting thousands of customers is High even when each instance is small.
Conduct risk outside financial services
The term is rarer outside financial services and the risk is not. Any organization that sells to people who know less than it does, pays staff on volume, or designs processes customers must navigate has conduct risk, and the audit approach transfers without change: find the incentives, find the product features that depend on customer inertia or ignorance, find the data signatures, test outcomes. Three adjustments for non-financial sectors. The criteria are usually consumer protection law, sector regulators’ guidance and the organization’s own stated values rather than a conduct regime, and the audit should say which. The owner is usually unidentified, because nobody has been given conduct as a responsibility, and the first finding is often that. And the board has usually never seen conduct indicators, so the audit’s report is also an education; the presenting to the audit committee guide covers how to introduce a risk the committee has not thought about. Healthcare billing (revenue cycle controls), subscription businesses, education providers selling courses, and any sales-driven organization are the obvious candidates.
Template: the conduct risk assessment record
Conduct risk assessment — [business line], [period]. Scope: [products, channels, customer segments, incentive plans in scope]. Criteria: [the organization’s conduct appetite v[x]; regulator expectations (named); product purposes as stated at approval]. Framework results: appetite and assessment [result]; product governance [result; products sampled]; incentive plans [plans reviewed; conduct features found]; consequence management [result]; reporting [result]. Behavioral test results: sales patterns [population, period; clustering ratio; reversals; sellers of concern (count, not names, in the report)]; complaints [volume, rate per 1,000, top root causes, internal uphold vs external overturn]; outcome testing [sample, unsuitable outcomes, rate vs tolerance]; early cancellation [rate, concentration]; vulnerable customers [over-representation ratio]; speak-up [reports, outcomes]. Harm identified: [customers affected, amount, remediation status]. Findings: [refs, ratings; mechanism for each: incentives / product / information / culture]. Conclusion: [whether the line manages conduct risk within appetite]. Prepared [name, date]; reviewed [name, date].
Worked example: Lakeshore Bancorp audits its retail sales incentives
Lakeshore Bancorp, the $9 billion regional bank used in examples across this site, has a 22-person internal audit function, a compliance department of about forty and a lead bank supervised by the OCC. Its FY27 plan included a 380-hour conduct risk audit of the retail banking sales incentive program, prompted by two signals: the complaints team had reported a rising share of “product I did not ask for” complaints, and the OCC’s prior examination had asked about sales practices oversight. The scope covered the retail deposit, card and consumer lending products sold through 41 branches and the contact center, the three variable-pay plans covering 610 sales staff, and the first-line sales quality program.
The framework tests found a conduct appetite statement with no measures and a product governance process that reviewed products at launch only. The incentive plan review found that the branch plan paid a 40 percent uplift on crossing a quarterly threshold of new deposit accounts and had no quality gate; compliance had never reviewed any of the three plans. The sales pattern analytic over 14 months of account openings found that openings in the last three days of each quarter ran at 3.1 times the daily average, that 2,140 accounts opened in those windows showed no customer-initiated contact in the preceding 30 days, and that 9 of the 610 sellers accounted for 31 percent of accounts closed within 90 days of opening. Complaints analysis found 412 “did not ask for” complaints in the period, of which 61 percent traced to the quarter-end windows, with an internal uphold rate of 22 percent against an external overturn rate of 58 percent on the cases that reached the ombudsman-equivalent process. Outcome testing of 40 recorded sales found 7 where the customer had not been told about a monthly fee that would apply after the promotional period. Consequence records showed that two of the nine high-closure sellers had been counseled for conduct breaches in the prior year and had received top-quartile bonuses in the same year. The speak-up channel had received one conduct report from retail in three years.
| Finding | Mechanism | Condition (abridged) | Rating | Action |
|---|---|---|---|---|
| F1 Incentive plan design | Incentives | Quarterly cliff-edge uplift; no suitability or persistency gate; plans never reviewed by compliance | High | Plans redesigned with a 90-day persistency gate and a complaints adjustment; compliance review required before approval |
| F2 Sales practices | Incentives, culture | 3.1x quarter-end clustering; 2,140 accounts with no prior contact; 9 sellers at 31 percent of early closures | High | Account-level review of the 2,140; customer contact and remediation; referral of the nine sellers to HR and legal under the protocol |
| F3 Complaints handling | Culture | 22 percent internal uphold vs 58 percent external overturn; root causes not analyzed | Medium | Independent complaints review; root cause reporting to the conduct committee |
| F4 Product disclosure | Information asymmetry | 7 of 40 sales omitted the post-promotion fee | Medium | Script change; outcome testing added to quality assurance |
| F5 Consequence management | Culture | Counseled sellers received top-quartile bonuses | Medium | Conduct gate on variable pay; documented consistency review |
| F6 Framework | — | Appetite without measures; product review at launch only; no conduct indicators to the board | Medium | Ten indicators with thresholds reported quarterly; in-force product reviews on a cycle |
The report was rated Unsatisfactory. The nine sellers were handled under the bank’s fraud and misconduct protocol, outside the report. Remediation contacted the 2,140 customers and refunded $186,000 of fees; the redesigned incentive plan took effect the following quarter, and the quarter-end clustering ratio fell to 1.4 within two quarters. The OCC’s next examination reviewed the audit and the remediation and raised no matter requiring attention on sales practices, which the chief audit executive attributed to the bank having found the problem itself; the MRA lifecycle guide describes what the alternative would have looked like.
Questions about conduct risk
What is the difference between conduct risk and compliance risk?
Compliance risk is the risk of breaking a rule. Conduct risk is the risk of harming customers, counterparties or markets through the organization’s own behavior, including behavior that breaks no rule. Every compliance breach involving customers is a conduct failure; most conduct failures are not compliance breaches.
Is conduct risk only a financial services concept?
The term comes from UK financial regulation, but the risk exists wherever an organization sells to people who know less than it does, pays on volume or designs processes customers must navigate. Healthcare billing, subscriptions, education and utilities have all produced conduct failures under other names.
Who owns conduct risk?
The business that designs the products, sets the incentives and serves the customers owns it, in a first line role. Risk or compliance provides oversight and challenge in a second line role, and internal audit assures the framework and tests outcomes. The first finding in many organizations is that nobody has been given the responsibility.
What are the best early indicators?
Complaint root causes, early cancellation rates, sales clustering around incentive thresholds, product claims or usage ratios, and the consistency of consequences for breaches. Each can be measured from data the organization already holds.
How does the Consumer Duty change conduct risk in the UK?
It replaced the expectation of treating customers fairly with a requirement to deliver good outcomes across products and services, price and value, consumer understanding and consumer support, with firms expected to monitor and evidence outcomes. It applied to open products from 31 July 2023 and closed products from 31 July 2024, and it makes outcome testing a regulatory expectation rather than good practice.
Can internal audit audit culture?
Yes, through its observable consequences: how breaches are handled, what incentives reward, what staff say in structured interviews and surveys, whether concerns raised produce outcomes. The IIA’s Organizational Behavior Topical Requirement, effective 15 December 2026, makes this a mandatory assessment subject when culture is in scope.
What should a small organization do first?
Read its own incentive plans for the five conduct features, run the sales clustering and complaints root-cause analyses once, and name an owner. Those three steps find most of what a first conduct audit would find, at a fraction of the cost.
Related guides
- Compliance risk: a comprehensive guide — the neighbor concept.
- Compliance vs compliance risk — the distinction on the compliance side.
- How to audit corporate culture — the Topical Requirement method for the culture mechanism.
- The Organizational Behavior Topical Requirement workbook — mandatory from 15 December 2026.
- Risk appetite statements that guide decisions — making conduct appetite measurable.
- Key risk indicators by risk type — building the conduct indicators.
- Fraud red flags library — the sales-anomaly flags shared with conduct.
- The payroll analytics catalog — compensation tests.
- When internal audit finds fraud — handling individual misconduct found during a conduct audit.
- What regulators really expect — how examiners test conduct.
- UK regulatory compliance post-Brexit — the UK regime.
- The MRA and MRIA lifecycle — when the supervisor finds it first.
- Internal audit in financial services — AML, compliance and conduct in banks.
- Hospital revenue cycle controls — conduct risk in healthcare billing.
- Writing cause statements — locating the cause in design, not people.
- Audit interview techniques — interviewing staff about targets.
- Risk taxonomy — building the categories everything else uses.
- How to audit operational risk management — the framework audit, test by test.
- Compliance Risk Assessment: Method, Scoring, Worked Example — obligations inventory, exposure scoring and prioritization that regulators accept
- Auditing the Ethics and Compliance Program: Tests & Metrics — a program-effectiveness audit mapped to the DOJ and Sentencing Guidelines criteria.
Leave a Reply