An organization should periodically evaluate the effectiveness of the program to prevent, detect and appropriately respond to noncompliance. Periodic evaluations provide an in-depth analysis of the program's design effectiveness (DE) and operating effectiveness (OE), as well as an opportunity to consider new best practices, technologies or other tools developed since the program was designed.
Principles
> Evaluate whether the program design is adequate to address all identified boundaries and risks
> Evaluate whether the program is operating as designed
Business Objectives
-
To ensure that the entity periodically evaluates the effectiveness of the compliance and ethics program
-
To ensure that the compliance and ethics program is followed, including monitoring and auditing to detect criminal conduct
Considerations
-
The length of time between periodic evaluations should be determined after consideration of likelihood of risks, impact of risks and history of compliance or ethics failures
-
An entity may evaluate different aspects of the compliance and ethics program, or systems in place at different locations or in various divisions, on separate schedules and with varied teams
-
Design effectiveness (DE) evaluations determine whether the related program elements are properly designed to achieve the programs objectives. Operating effectiveness (OE) evaluations determine whether the program elements are in fact operating as designed. Benchmarking evaluations (BE) help an organization understand how its compliance and ethics activities compare to other organizations' activities (quality, cost, speed of execution).
Critical Success Factors
-
Personnel designing and executing the evaluation must have appropriate skills and qualifications
-
Personnel executing the evaluation must have the independence, authority and organizational standing to conduct the evaluation objectively and report the results without fear of reprisal