Risk Assessment by Averaging Optimism

The core defect: every category scoring 3.1–3.4 means the instrument has no discriminating power. A method that cannot separate high from low risk cannot allocate resources, and therefore does not function as a risk assessment - it is an opinion poll with a number attached.

Specific failures:

• Single method, single perspective. Twelve executives answering a survey measures confidence, not exposure.
• No anchored scales. "3" means something different to each respondent; averaging ordinal judgments produces a meaningless mean.
• No data inputs. Hotline trends, audit findings, third-party diligence results, payment/commission data, and country risk indicators are all ignored.
• No owner validation and no output. If the results do not change the audit plan, training plan, or monitoring plan, the exercise is theater.

Replacement, feasible for 2.5 FTE:

1. Define risk as likelihood × impact, with written anchors for each level (impact expressed in dollars and regulatory consequence; likelihood expressed in frequency evidence).
2. Use at least three data sources per risk: internal (hotline, audit, monitoring, expense analytics), external (country indicators, third-party diligence), and business input (workshops, not surveys).
3. Run two or three 90-minute workshops with business and finance rather than a 12-person survey. Have risk owners validate the scores in writing; the disagreement between compliance's view and the business's view is itself the finding.
4. Cap the scope at the top 15 risks. With 2.5 FTE, depth beats coverage.
5. Require an output contract: each top risk gets an owner, a control, and a monitoring or audit response. Publish the mapping so the Board can see the link.

Reasoning to state: the goal is defensible prioritization, not statistical elegance. Documented judgment beats a precise average of uncalibrated opinions.

Top risks for a distributor-led launch:

• Third-party/intermediary risk - the distributor's government interactions and beneficial ownership are the dominant exposure.
• Government touchpoints - permits, customs clearance, and any state-owned customer relationships.
• Payment structure - commissions, success fees, discounts, and any off-invoice payments.
• Gifts and hospitality - local practice at launch events.
• Controls capability - the distributor's own books and records.

90-day sequence (order matters):

1. Diligence before signature (weeks 1–4). Ownership and beneficial ownership, reputation and litigation search, government connections, prior debarment or enforcement history, and the distributor's own controls. Risk-rank the result; high risk means reconsider or impose enhanced terms.
2. Contract terms before launch (weeks 4–8). Anti-bribery representations, audit rights, no off-book payments, training obligation, termination for breach, and a commission structure that does not tie payment to obtaining government approvals or permits.
3. Training and onboarding before first sale (weeks 6–10). Distributor staff trained on the Code, GHE, and government-interaction rules; a named relationship owner on our side accountable for compliance questions.
4. Pre-approval gate. All government-official interactions and hospitality pre-cleared through a defined channel with a 24–48 hour service level, so the gate does not become the reason people route around it.
5. Enhanced monitoring for the first six months. Payment review, expense review, and a check-in cadence - set this up before launch, not after the first problem.

Reasoning to state: with a 90-day clock the temptation is to launch first and control later. Diligence and contract terms are the two steps that cannot be retrofitted; training and monitoring can be strengthened after launch but not skipped.

Two distinct tracks, different tools, different timelines.

Diligence (pre-close) - the goal is price and protection:

• Agents are the headline. 40 commission-paid sales agents selling to state-owned utilities is the highest-risk profile in the deal. Sample their contracts, payment terms, and any government-official interactions. Determine whether agents are exclusive, whether commissions are success-based on state contracts, and whether any have government family ties.
• Look for successor liability. Prior payment practices, gift and hospitality records, litigation, debarment exposure, and any whistleblower complaints.
• Negotiate protections: anti-bribery representations and warranties, indemnities, escrow, and where findings are material, a specific price or closing condition.
• Do not accept "no compliance function" as a neutral fact. It means there are no records - absence of evidence is not absence of risk.

Post-close (first 100 days) - the goal is control:

• Extend the Code, hotline, and training to the target immediately; the hotline extension is cheap and signals intent.
• Risk-rank and disposition all 40 agents: terminate or restructure the highest-risk relationships first, then contract, train, and monitor the rest. Do not wait for a full program build.
• Harmonize approval thresholds and GHE into the target's workflow, not just the policy library.
• Assign a compliance business partner to the site and add Poland to the monitoring plan and the next risk assessment.
• Report integration status to the Audit Committee at 100 days and again at 12 months.

Reasoning to state: diligence findings should change the deal terms; integration findings should change the controls. Merging the two tracks is how acquirers end up inheriting conduct they knew about but did not price or plan for.