Risk, Compliance and Ethics
Three different obligations
Risk management asks what might happen and what we will do about it. Compliance asks whether we meet defined obligations. Ethics asks whether we should, even where no rule compels it. A question may be answerable only by the third.
Concepts to hold
- Risk versus issue. Risk is uncertain and future; an issue has occurred. A risk that materialises becomes an issue and leaves the register for the issue log.
- Register content. Cause, event, effect, owner, likelihood, impact, score, response, residual score, review date. A risk without a named owner is not managed.
- Response strategies. Avoid (remove the cause), reduce (lower likelihood or impact), transfer (shift financial consequence, e.g. insurance - reputational risk generally cannot be transferred), accept (with a stated rationale and owner), and escalate (beyond local authority).
- Appetite and tolerance. Appetite is the willingness to accept risk in pursuit of objectives; tolerance is the operational threshold that triggers action.
- Ethics in practice. Conflicts of interest declared and managed, not merely noted. Confidential data handled on a need-to-know basis. Pressure to misreport progress is an ethical escalation, not a reporting preference.
Traps
Treating a low score as automatically acceptable without reference to appetite. Assuming transfer removes responsibility. Confusing legal compliance with ethical adequacy - both questions appear, and the answer differs.
Rule of thumb: score, then judge
Score = likelihood × impact on a defined scale, but decide with appetite. A 20/25 supply risk may be acceptable to a business with alternatives and unacceptable to one without.
Worked illustration
Likelihood 4, impact 5 gives 20. If appetite permits only scores below 12, a response is mandatory: avoid by dual-sourcing, or reduce through buffer stock - accepting requires executive sign-off with documented rationale.