Compliance risk: a top-10 hit list; This 'grandmother test' will be helpful in setting your compliance risk management agenda for 2007.

• Author: Cellini, Richard J.
• Position: INFORMATION FOR THE BOARD

CORPORATE BOARDS are charged with overseeing two kinds of things: anything that can kill a company (i.e., risk), and anything that can make it rich (i.e., opportunity). Unfortunately, risks are multiplying much faster than opportunities. The modern economy has invented dozens of new ways a company can experience sudden death, while the occasions for reaping sudden wealth remain few and far between.

Entire categories of corporate risk are often invisible to directors today. These blind spots should be eliminated, and eliminated quickly.

Not so long ago, most directors monitored just one type of risk--financial risk. Today, sensible directors monitor not just financial threats to corporate well-being but also nonfinancial threats.

The core risk areas

Risk management shouldn't be so mysterious. The board's risk management agenda should be able to pass the "grandmother test"--it should be reduced to a short list that your grandmother can easily read and understand. To be expert at risk management means focusing on 10 core risk areas:

1. Ethical Corporate Culture: Corporate ethics must inform not just individual conduct, but also organizational behavior. Pro-compliance structures, incentives, policies, practices, and procedures are critical in building and maintaining a culture of ethical behavior and compliance.

2. Antitrust and Unfair Selling Practices: Consumers are entitled to a marketplace free of collusion, unfair restraints on trade, and other improper selling practices.

3. Bribes, Gifts, and Conflicts of Interest: Corporate employees are free to pursue their company's best interest, and to do so with vigor. But some forms of persuasion are strictly regulated. Personal gifts and incentives to key decision-makers (public or private) are frequently forbidden. And conflicts-of-interest should be carefully avoided and promptly disclosed.

4. Financial Integrity and Fiduciary Trust: Financial wrongdoing and fiduciary misconduct are never "victimless"; the true victims are often simply unseen and unheard (e.g., the company's shareholders and the company itself). Most laws regulating financial integrity and fiduciary obligations exist to protect the rights of corporate entities and the investing public.

5. Recordkeeping and Reporting: Corporations should preserve all records required to be kept by law, retain them for as long as required (but often not longer), and disclose them to the authorities and other third parties when appropriate. As a general...