Risk Management, Investigations and Dispute Resolution
Assess, Investigate, Resolve
Risk management. Identify risks, assess them on likelihood × impact, and treat by accept, avoid, mitigate or transfer. The three lines model distinguishes business ownership of risk, an independent risk/compliance function, and internal audit assurance. Risk appetite statements, key risk indicators, control testing and issue tracking turn policy into evidence. Regulators consistently ask not whether a risk existed but whether it was identified, escalated and remediated.
Investigations. Triggered by hotlines, audit findings or regulator contact. Sequence: scope and authority, independence, litigation hold and preservation, privileged engagement of counsel, data-privacy-compliant collection, interviews, factual findings, remediation and discipline, and consideration of self-reporting and cooperation credit. Traps: allowing the business to run the investigation; circulating privileged reports too widely; ignoring employee-monitoring limits; failing to document the hold (which invites spoliation sanctions and adverse inferences).
Dispute resolution. Check governing law, forum and any tiered clause (negotiation, then mediation, then arbitration). Mediation is non-binding unless a settlement is signed; arbitration is binding, enforceable under the New York Convention, with limited appeal and a defined seat and rules. Litigation offers broader discovery in common-law systems but slower timelines. Always check limitation periods and interim relief options.
Rule of thumb: preserve first, scope second, interview third, conclude fourth - and never let the subject of the investigation control the evidence.
Worked example: a whistleblower alleges bribery in a subsidiary. Issue a hold the same day, engage external counsel, and pause the local HR inquiry until scope is agreed.