By: Rodrigo Taboada y Mónica Brenes
A good compliance program in a company must have risk mapping and a whistleblower channel.
In order to reduce the risks of becoming involved in corrupt practices or being in non-compliance with its internal and external regulatory obligations, it is important that the company performs a risk mapping, which is recommended to be done through the development of a matrix in which representatives of the most important areas within the company’s operations participate to identify the risks they face, as well as the current status of compliance in which they are and the best way to mitigate them.
Once the risk matrix has been drawn up, it is important to designate a responsible team to provide constant follow-up so that the project is developed and the established objectives can be achieved. Likewise, a re-evaluation period must be established, since risks may vary due to many factors. During the development of this whole process it is important that the company keeps its cultural identity in mind, implementing the project according to its mission, vision, values and objectives.
In addition, it is important that within the compliance program there are also whistleblowing mechanisms, which should be carried out both for internal sources (company employees) and external sources (customers and suppliers of the company). There are several models for implementing whistleblowing channels, such as a physical mailbox, an e-mail, a call center, an established escalation process, among others.
The established whistleblowing channel(s) should be made known to the company’s employees, suppliers and customers, so that they immediately recognize the process for reporting a complaint. Likewise, the company should establish an investigation process to follow up on the complaint and close the case in the best way possible, addressing the needs of the parties and identifying opportunities for improvement within its operations. Through the complaints deposited in the whistleblower channels, new risks can be identified and added to the risk matrix for proper mitigation.
The risk matrix and the complaints channel are two extremely important elements in the compliance program, however, there are other essential stages that must be complemented for a good development of a compliance system in a company, which will be discussed in other articles.