iso27diy-corp/Corpus/Information Security/Identifying and Managing Preventable Risks.md

1.5 KiB
Raw Permalink Blame History

Sidebar from Managing Risks - A New Framework

Companies cannot anticipate every circumstance or conflict of interest that an employee might encounter. Thus, the first line of defense against preventable risk events is to provide guidelines clarifying the companys goals and values.

Define the Mission A well-crafted mission statement serves as a “true north” for all employees. E.g. Johnson & Johnsons “We believe our first responsibility is to the doctors, nurses and patients, to mothers and fathers, and all others who use our products and services”.

Articulate the Values that guide employee behavior toward all stakeholders

Set Boundaries for what is and what is not allowed. Companies need corporate codes of business conduct that prescribe behaviors relating to conflicts of interest, antitrust issues, trade secrets and confidential information, bribery, discrimination, and harassment. top managers must serve as role models and demonstrate that they mean what they say. Companies must institute strong internal control systems, such as the segregation of duties and an active whistle-blowing program, to reduce not only misbehavior but also temptation. A capable and independent internal audit department tasked with continually checking employees compliance with internal controls and standard operating processes also will deter employees from violating company procedures and policies and can detect violations when they do occur.