IO GRC Assignment 10: Governance, Risk, and Compliance Report

This report presents a comprehensive analysis of a Governance, Risk, and Compliance (GRC) assignment focusing on an International Organization (IO). The assignment addresses key issues arising from the appointment of a new sales director, including the lack of compliance team involvement in new projects, leading to regulatory, reputation, and business risks. The report outlines the risks associated with non-compliance, such as regulatory breaches, reputational damage, and financial losses. Strategies to mitigate these risks are proposed, including reporting to the board, conducting compliance risk assessments, providing compliance training, and establishing a robust compliance program. Furthermore, the report details a risk management process aligned with an internal restructure, emphasizing risk-based assessments, compliance monitoring, internal audits, and reporting to senior management. The report also prepares for a regulatory interview, detailing the importance of staff training and outlining the roles and responsibilities of key personnel. The assignment highlights the need for a proactive approach to GRC, emphasizing the importance of stakeholder involvement, clear communication, and a strong compliance culture to ensure business sustainability and development.

Running head: GOVERNANCE, RISK AND COMPLIANCE ASSIGNMENT
1
Governance, Risk and Compliance Assignment
Student Name
Institution Affiliation

GOVERNANCE, RISK AND COMPLIANCE ASSIGNMENT
2
Question 2
The appointment of the new sales director for the International Organization (IO) has introduced
several changes to the firm affecting the assurance functions specifically. John, a senior member
of the compliance team, has noticed how they are not involved in the development of new
projects as it used to be and this puts the organization prone to risks associated with compliance.
The activities in IO expose three main risks namely regulatory risk, reputation risk as well as a
business risk.
Regulatory risk is a major risk caused by the lack of involvement of the compliance team which
is responsible for ensuring that the organization adheres to all the local and international
regulations. Breach of regulatory requirements in the development of new projects will lead to
severe repercussions including fines and restrictions for the organizations from the regulatory
bodies. Breach of regulatory requirements comes with punitive measures that will disrupt the
efficient and smooth operations in the organization. Also, the activities in IO lead to a lack of
product approval from the compliance team in the organization. The compliance team is well
specialized in the regulatory requirements but they are not involved in the product development
thus the new products are not approved in terms of compliance. The compliance team used to be
involved from the early stages of product development and their expert comments were
considered by the development team thus resulting in the production of compliance products.
The compliance teams would point out any breach of regulatory requirements thus avoid the
punitive measures set to deals with organizations breaching the regulatory requirements. Since
the new sales director does not involve the compliance team, it is likely that the regulations
regarding sales and advertisement may be missed out. The new director is less familiar with the

GOVERNANCE, RISK AND COMPLIANCE ASSIGNMENT
3
sales and advertisement regulations compared to the compliance team that has worked together
for many years to come up with compliance products.
The activities pose a reputation risk for the organization. Producing products without compliance
considerations is likely to make customers unhappy. For instance, the customers may complain
to the regulator which is likely to ruin the compliance reputation of the firm to the customer and
regulator. Customer satisfaction is an essential element in any organization and IO cannot afford
to destroy their reputation to their customers and the public. The non-compliance issues from the
customers may be picked by media houses thus resulting in negative media which consequently
destroys the brand's public image. Reputation has a great impact on branding and establishing
customer loyalty and the activities are a threat to the good reputation that IO has with its
customers.
Additionally, the activities in the organization pose a business risk. Luck of compliance to the
regulatory requirements in sales and advertisement is likely going to force the organization to
pay a huge amount of money to the regulatory body as punishment. Such a scenario will make
the organization to incur losses or reduce the profit margins. Also, complaints from the
customers is a sign that customers are not satisfied and they are likely to get products from other
firms offering similar goods and services. Consequently, IO would lose its competitive
advantage and its competitors are likely to utilize the opportunity to increase their market share.
Several strategies and measures exist which John would take to ensure that the IO eliminates the
risks introduced due to the activities of the new sales director. First, John should report the
situation to the Board and Management of IO. This would be the right action for John since his
attempt to arrange for a meeting with the new sales director has failed and the situation is likely

GOVERNANCE, RISK AND COMPLIANCE ASSIGNMENT
4
to affect everyone in the organization. Once the top management is informed, John can outline
the other measures that would ensure compliance in the organization with the backup of the top
management.
John should recommend a compliance risk assessment, especially in the sales department. This
assessment will identify the specific compliance risk as well as the regulations and internal
controls required to ensure that the sales department under the new director is compliant. The
gaps in the compliance analysis should be well documented and reported to the top management
to seal the loopholes. This will ensure that the compliance risks identified are eliminated or
reduced to negligible levels.
Also, John should ensure that the sales department receives specific training sessions on
compliance through the corporation of the human resource department. This training should
train the sales department about compliance breaches and use popular examples such as the
Wells Fargo incident. During the training, compliance should be added as a key performance
indicator for the sales department. Furthermore, a compliance program can be initiated to
strengthen the compliance culture across the organization.

GOVERNANCE, RISK AND COMPLIANCE ASSIGNMENT
5
Question 3
Risk Management Process
As the interim head of the regulatory compliance department, the risk management process
would be aligned with the internal restructure in International Organization. Since the new
structures give function heads responsibility for risk management under their area, the
compliance management is going to be divided into small units. The compliance risk assessment
in the organization is going to take the risk-based approach in every department in the
organization. The risk management process is going to use the departments as the basic units for
compliance risk assessment then all the risks identified are compiled and reported to the board of
management to review and give guidance on the compliance issues highlighted.
The risk management process should have the following steps;
 Identify compliance risk inherent in each business unit- Every business unit on the
organization has its unique operations thus the compliance risks vary from one business
unit to another. Since the function heads are responsible for risk management in their
business units, they should involve the risk assessment team to identify the compliance
risks in their departments. Identification of the compliance risk in every department will
help in planning how the department and organization at large are going to reduce or
eliminate the compliance risks in the organization.
 Assess Risk. Risk assessment should be done to analyze the probability and impact of the
risks in every department based on the regulations, procedures, policies and internal
controls in the organization. The probability, as well as the impact of every risk to the
organization, differs thus the risk assessment should precisely analyze these aspects for

GOVERNANCE, RISK AND COMPLIANCE ASSIGNMENT
6
the risks identified in every department. The risks with high probability and a greater
impact of the organizations should be given a priority compared to the less likely
compliance risks and those whose impact will not disrupt the operations within the
organization. The internal controls and compliance procedures must have already existed
since the organization has not been involved in any significant compliance breach but
they should be strengthened to promote the compliance culture and control within the
departments and the organization in general.
 Compliance monitoring. After the identification and assessment of the compliance risks,
every department should have a compliance monitoring program to ensure that the risks
are well controlled within acceptable levels. The program should outline the regulatory
requirements to be met by every department. Also, the departmental heads can delegate
the risk management responsibilities to other team members.
 Review by the internal audit. An internal compliance team should then review the risk
assessment from every department by determining the validity and reliability of the risk
assessments. The internal audit is mandated to review the accuracy and reliability of the
assessment done by the entire department as well as consolidate a report for all the
compliance risks in the organization. The audit team will ensure that the regulatory
requirements and procedures have been observed during the departmental risk
assessments. Also, the audit will highlight the risks with high probability and a huge
impact on the organization. The audit team will be neutral and should not be aligned to
any other department in the organization to remove any bias in the risk assessment
process.

GOVERNANCE, RISK AND COMPLIANCE ASSIGNMENT
7
 Board and Senior Management Reporting- Once the internal audit is complete, the team
will document the compliance risks in every department and those facing the entire
organization. The internal audit team will then highlight their conclusion and
recommendations before forwarding the report to the board and senior management. The
senior management is expected to go through the report and authorize the
recommendations of the report for implementation. The top management can also include
additional strategies that would ensure IO has a strong compliance culture to provide a
good environment for business sustainability and development.
The risk compliance process outlined above is going to be effective in the organization since it
has touched on all the crucial elements of compliance risk assessment. The process identifies the
risk of each business unit across IO thus all the possible risks will be handled with no exclusion.
Again, the process has put measures and policies to mitigate the risk such as the compliance
monitoring program. Furthermore, the reviews by the internal audit ensure that the risk
assessment process is valid and reliable. The internal audit also comes up with recommendations
that will help IO to attain perfect compliance.

GOVERNANCE, RISK AND COMPLIANCE ASSIGNMENT
8
Question 4
Regulatory Interview
The regulator of IO is going to undertake a visit and as the interim head of the regulatory
compliance department, I am responsible for putting things in order before the visit. The fast
action is to go through the report proceed by the predecessor after the last year’s regulatory visit.
Several issues can be identified from the analysis of the reports and audit risk log thus the
executive board should be made aware of the situation at hand. Some of the issues such as staff
training which were highlighted by the regulator in the previous report have not been highlighted
in the board meetings thus meaning they have not been addressed. The executive board is going
to be challenged thus I should inform them and see how they can make arrangements to touch on
the issues highlighted in the previous visit.
All the people likely be interviewed during the regulatory visit should be prepared in advance
and prepare to answer questions about their specific roles and responsibilities in regulatory
compliance. The following people are likely going to be interviewed. Their roles and
responsibilities have also been briefly outlined. The department and people mentioned below
should prepare in advance how to demonstrate their implementation of the previous year’s
regulatory visit report.
 Senior management - responsibility for managing the regulatory risk of the
organization
 Head of Business units – Managing regulatory and prudential risks within their units
 HR - Induction, Approved functions recruitment, training
 Compliance – Compliance Risk Management

GOVERNANCE, RISK AND COMPLIANCE ASSIGNMENT
9
 Risk management – Organizational risk management
 Internal Audit- Review and reporting gaps
Staff training was highlighted in the previous regulatory visit and this issue should be addressed
since it is likely to introduce compliance risks during the next regulatory visit. Timing,
regularity and content of training around the conduct of business activities require proper
planning and coordination from all departments especially the compliance department and the
human resource department in IO. Lack of training raises several risks to the organization such
as customer complaints, regulatory breaches, suitability, disclosures, unfair sales practices and
conflict of interest. Staff training is essential in ensuring that an organization offers its customers
high-quality products and services thus achieving customer satisfaction and building a strong
brand.
The risks introduced due to the lack of training can be eliminated through various strategies. The
strategy that IO can implement is to formulate and implement a comprehensive training plan.
The plan should outline the content of the training, the people to be trained, how to be trained,
where to be trained as well as the assessment that will be performed to measure the learning
process. The plan should outline the periodic training intervals to ensure that the staff members
are well updated about the changing regulatory requirements. Also, the HR department should
ensure that new employees received compliance training after recruitment.
The visit from the regulator has potential opportunities and challenges for the International
Organization (IO). The visit offers several opportunities for the firm. First, it gives an
opportunity for IO to do a gap analysis which will help in the identification of weaknesses in the

GOVERNANCE, RISK AND COMPLIANCE ASSIGNMENT
10
rules by the board and the management. Also, the visit will make the organization remedy the
compliance risks at hand by filling the gaps identified in the analysis. Again, the organization
will improve on the Board and Management reporting as several weaknesses were identified in
the reports resulting from the previous regulatory visit. Also, as a way of preparing people for
the regulatory visit, IO will have an opportunity to communicate its compliance culture across all
departments in the organization. Furthermore, the visit will give IO a chance to communicate to
the regulator the various steps taken by the organization to rectify the gaps identified in the
regulator's report.
The main challenges of the visit include dealing with timelines and the regulator commenting on
the weak Board oversight. The visit is already scheduled and the IO has to put things in order
within the provided timelines. This puts pressure on the organization as they have to prepare for
the visit and run normal operations concurrently. The Board oversight will be in the spotlight as
the issue of training was not discussed in their general meeting and they did not read the entire
regulatory report. Regulatory compliance and oversight are the responsibility of the board but
they failed to address the key issues outlined by the regulator.