An organization should establish a plan of action to implement responses and initiatives that address identified risks while promoting the organization's principles/values and ethical culture. The plan should indicate how the program will be enhanced (or initially created) to address identified risks and opportunities. Even in the absence of risk, management may decide to take certain actions to promote specific principles/values.
The plan should indicate how the program integrates with the overall business model and context. In addition, the plan should include a strategy regarding how the organization will affirmatively address the workforce's normal resistance to change. Importantly, the plan and the resources required to execute the plan should be explicitly authorized by senior management.
Principles
> Plan defined and authorized
> Portfolio view of projects/initiatives
> Operators accountable for certain risks and initiatives to reduce risks
> Mix of preventative, detective and responsive structures
> Adequate resources allocated to carry out the program
Business Objectives
-
To ensure that values, ethics and integrity are promoted
-
To ensure that all events presenting risk have defined responses that take into account potential opportunities
-
To ensure that the entity allocates adequate resources and authority to carry out program activities
-
To integrate the compliance and ethics program with the business architecture
-
To ensure that program strategy addresses the issue of change management
Considerations
-
The level of plan detail and specificity will depend upon the size and maturity of the program
-
Strategy will become more mature as the program grows and develops its role within the business architecture
Critical Success Factors
-
Clear understanding of the business architecture and business model
-
Commitment of necessary resources