Compliance, Anti-Corruption and Risk Management
This domain tests whether the first head can build a system that prevents violations and can evidence it, rather than react after the fact.
Anti-corruption law
The Law on Combating Corruption (No. 410-V of 18 November 2015) defines corruption and requires an anti-corruption compliance service for quasi-public sector entities, natural monopoly subjects, entities with state participation and others provided by law. The service must be independent, report to the board or the first head, and run risk assessment, conflict-of-interest declarations, counterparty due diligence, a gifts and hospitality policy, and protected whistleblowing channels.
AML and internal control
Entities subject to financial monitoring apply internal control rules, customer due diligence and record-keeping. Internal control rests on five components: control environment, risk assessment, control activities, information and communication, and monitoring.
Risk management
Practical tools: a risk register, a likelihood-by-impact matrix, a defined risk appetite and tolerance, and the three-lines-of-defence model - operations own the risk, compliance and risk functions oversee, internal audit provides independent assurance.
Worked example
A supplier offers the first head a watch before contract renewal. Accepting creates a conflict of interest and a corruption risk even if no decision is promised. Correct handling: refuse, record the offer in the gifts register, disclose to the board and re-run counterparty due diligence.
Traps
Assuming compliance is only a banking obligation; treating the policy as sufficient without evidence of application; ignoring intermediaries and agents; failing to document disclosures.