【NAVEXGlobal】2024风险抵御策略指南掌握风险管理主动权_30页_921kb

Risk Resilience Guide Summary

Core Content

This guide focuses on the importance of risk resilience in modern business operations, emphasizing the need for a proactive, systematic approach to regulatory risk management and third-party risk management (TPRM). It outlines the growing complexity and volume of global regulations, the increasing risks posed by third-party relationships, and the necessity of compliance program operational risk management (CPORM) to navigate these challenges effectively.

Main Challenges

• Reactive Risk Management: Many organizations adopt a "check-the-box" approach, addressing issues as they arise rather than proactively identifying and mitigating risks.
• Dynamic Regulatory Environment: Regulations are constantly changing, with new laws being introduced and updated, particularly in areas like ESG compliance, data privacy, and artificial intelligence (AI).
• Third-Party Risks: As supply chains become more global and complex, third-party relationships pose significant cybersecurity, compliance, reputational, and financial risks.
• Operational Vulnerabilities: The risk landscape is evolving rapidly, and organizations must continuously monitor and adapt to new threats and regulatory expectations.

Key Trends

• Regulatory Pressure:
  • The EU AI Act can impose penalties up to 7% of global annual turnover or €35 million.
  • The U.S. has seen $1.19 billion in fines for sanctions violations by a telecoms company in 2017.
  • In 2023, an American data storage company was fined $300 million for breaching U.S. export controls.
• Global Regulation Increase:
  • There are 234 regulatory change events daily globally.
  • 40% of organizations have improved compliance with regulatory standards in the past 12 months.
  • 31% have improved risk identification and tracking.
  • 30% have achieved greater integration of risk management across business functions.

Key Concepts

• Regulatory Risk: The risk of negative impact from non-compliance with global and local regulations. Examples include the U.S. Foreign Corrupt Practices Act (FCPA), EU General Data Protection Regulation (GDPR), and German Supply Chain Act.
• Third-Party Risk Management (TPRM): Managing risks from external partners, such as vendors, suppliers, and service providers. This includes risks like cybersecurity, compliance, and reputational damage.
• Compliance Program Operational Risk Management (CPORM): A systematic, ongoing process to identify, assess, mitigate, and monitor risks. It includes horizon-scanning, risk triaging, and scenario planning.
• Operational Risk Management (ORM): Managing risks in a continuous, data-driven manner to ensure business continuity and resilience.
• IT Risk Management (ITRM): Managing IT-related risks, including cybersecurity threats, system failures, and data breaches.

Best Practices

• Proactive Risk Management: Shift from reactive to proactive by using data analytics, scenario planning, and ongoing monitoring.
• Systematic Approach: Implement a continuous and systematic process for risk assessment and mitigation.
• Cultural Shift: Encourage a risk-aware culture across all business units, including HR, information security, and compliance.
• Technology Integration: Leverage shared technology for internal reporting, training, and third-party screening to ensure alignment and reduce risk exposure.

Key Statistics

• Only 29% of businesses take an optimal risk-based approach.
• 75% of organizations plan to increase spending on technology to monitor and detect risks.
• 36% of organizations use a risk-based approach for third-party management.
• 31% of chief risk officers rank third-party risk as their greatest threat to growth.
• 12% of money from detected fraud was recovered by the U.K. government in 2021.
• 16% of public sector data breaches are due to collusion.

Conclusion

Organizations must move beyond a reactive mindset and embrace a strategic, proactive, and continuous approach to risk management. By doing so, they can better protect their business continuity, reputation, and financial stability in an increasingly complex and interconnected world. The guide advocates for the adoption of compliance program operational risk management as a best practice to effectively manage regulatory and third-party risks.