Anti-corruption controls are unique, as they
go far beyond the typical transaction-level
controls that are most frequently designed
to prevent financial errors. For purposes of
this discussion, all risk mitigating efforts,
activities, controls, and processes instituted
or taken by the enterprise are referred to as
“anti-corruption risk mitigating controls”.
Mapping controls and other mitigating
activities to each corrupt activity or scheme
is important because the controls should
be commensurate with the probability and
potential outcomes of misconduct. Once the
inherent risk is determined for each identified
scheme, the risk assessment can proceed with
identifying and cataloguing risk mitigating
controls and processes that are in place.
For many large, global enterprises, this is
often a multi-stakeholder, cross-functional,
and cross-border effort. While some controls
operate enterprise-wide as part of the overall
control environment, many others are
embedded in business processes owned by individual
functions, including sales, procurement,
and logistics, or by the management of
operating units associated with a particular
geographic area or business segment. Some
controls may be of a financial nature or
owned by the finance function (e.g., travel
expense report approval or vendor invoice
payment authorization); others may fall
under the legal or compliance domain (e.g.,
contract language and review processes,
whistleblower hotlines), while still others
may belong to HR (e.g., employee background
checks), or business leaders (e.g., tone from
the top.) Therefore, identifying and cataloging
controls, just like identifying corruption
risk factors and schemes described earlier, is
likely to involve a number of people within
the enterprise.
For smaller or medium sized enterprises,
the identification of controls can typically
be centralized to a select few key busi