IDENTIFYING EXISTING MEASURES
STEP 4
To make the organisation and employees more resilient to integrity risks, an organisation needs to take measures. Measures may vary in scope and approach. Several measures are often already in place, sometimes without those measures being explicitly linked to the specific risks of a role. Measures may be generic, i.e. organisation-wide, or specific, meaning focused on a role. Both are important and require ongoing attention.
TYPES OF MEASURES: SCOPE
- Generic measures are measures aimed at the entire workforce. Examples include components of the integrity infrastructure aimed at encouraging a safe working environment in which employees experience no barriers to raising concerns and reporting suspected integrity violations.
- Specific measures are intended to improve the resilience of a particular work area or task, or to reduce concrete role-specific risk factors. Examples include stricter screening for employees with high-risk tasks or the introduction of the four-eyes principle for certain tasks.
TYPES OF MEASURES: APPROACH
- Preventative measures are intended to prevent and reduce risks.
- Detective controls are intended to determine whether certain risks occur.
- Remedial measures can be used to remedy situations in which risks materialise.
Measures must be reviewed regularly to check whether they are still sufficient. Furthermore, the measures must, of course, be practicable and applied effectively. The organisation may not immediately have a full picture of all existing measures. It is therefore important to discuss this with the relevant team, the manager and subject-matter specialists in order to be properly informed about the measures. In doing so, also take account of unwritten rules in the workplace and the culture within teams. Such aspects can also contribute to reducing risks. Once you have a good overview, the next step is to effectively tighten or update existing measures and work on appropriate measures where they are still lacking.
| Role name | Sales representative | |||
| Tasks | Customer acquisition and maintaining existing relationships | |||
| Work area | Situation | Possible risk | Vulnerabilities | Preventative measures |
| Contact with third parties | The employee is responsible for recruiting and accepting new customers | The employee accepts a dishonest customer as a result of manipulation | Financial bonus per referred customer | Mandatory advice from the legal department |
Explanation
In the example, the review shows that preventative measures are already in place. One of these is mandatory advice from the legal department when a customer is onboarded. This partially limits the representative’s authority.