“Just-in-time” risk assessment

In 1994 I spoke at a meeting of a company’s executives that took place shortly before the end of the company’s financial quarter, and in the same session the CEO made the point that the executives needed to be vigilant against any mischief designed to dress up the quarter. This was my first exposure to “just-in-time” training/communication. And although more companies time their compliance measures in this sort of way now than did then (mostly because there are more measures to time), it is an area where many organizations can and should up their respective games.

The basic idea of just-in-time communications (also sometimes called “point of risk” communications) – as described in this post – is that compliance communications are most likely to have the desired impact if delivered shortly before exposure to the risk in question. As noted in that post, this mechanism could be used to address a wide range of risks: “anti-corruption – before interactions with government officials and third-party intermediaries; competition law – before meetings with competitors (e.g., at trade association events); insider trading/Reg FD – during key transactions, before preparing earnings reports; protection of confidential information – when receiving such information from third parties pursuant to an NDA; … accuracy of sales/marketing – in connection with developing advertising, making pitches; and employment law – while conducting performance reviews…”

To his discussion I would like to add the notion of a just-in-time risk assessment.  Specifically, when conducting risk (or program) assessment interviews or surveys, compliance personnel should inquire a) for any given area or risk, whether there is a need for just-in-time training/communications; and b) if so, what the specifics of such training/communications should be.

Finally, the need to look for opportunities of this sort can be added to lists of managers’ C&E duties (e.g., those set forth in the code of conduct, training for new managers, and perhaps personnel evaluations). This will not only help companies develop more “just-in-time” communications but will raise the level of managers’ C&E knowledge and commitment generally.