Compliance, Ethics, Sustainability and Enterprise Risk

Introduction

Modern corporate governance extends beyond financial reporting and formal legal compliance. Boards and executives are expected to oversee how the enterprise identifies legal, ethical, environmental and social risks; prevents misconduct; responds to regulators; and communicates its impacts to investors and society. A company may satisfy the literal wording of a rule and still fail in governance if its culture rewards concealment, its controls are poorly designed, or its sustainability claims mislead stakeholders.

Compliance, ethics, sustainability and enterprise risk are therefore interconnected. Compliance establishes minimum obligations; ethics informs responsible judgment where rules are incomplete; sustainability considers long-term effects on people, the environment and enterprise resilience; and risk management integrates uncertainty into strategic decision-making. The central managerial challenge is to convert these ideas into a functioning system of responsibilities, controls, information flows and accountability.

This chapter adopts a risk-based perspective. A risk-based system does not treat every obligation or business activity identically. It directs greater resources toward activities, jurisdictions, customers, transactions and third parties presenting higher exposure. It also recognizes that effective governance requires both prevention and learning: organizations must detect problems, investigate them fairly, remediate root causes and improve controls.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Explain the relationship between compliance, ethics, sustainability and enterprise risk management.
2. Design the principal elements of a risk-based compliance program.
3. Evaluate codes of conduct, internal controls, reporting channels and investigation procedures.
4. Explain the governance significance of anti-money laundering and anti-corruption controls.
5. Integrate ESG, climate risk, human rights and sustainability disclosure into board oversight.
6. Identify and prevent greenwashing and misleading non-financial claims.
7. Assess regulatory engagement, technology use and emerging risks from a managerial perspective.

1. The Governance Architecture of Responsible Enterprise

1.1 Compliance, ethics and risk distinguished

Compliance is adherence to applicable law, regulation, contractual commitments and internal policies. It includes obligations relating to securities markets, competition, employment, data protection, taxation, consumer protection, financial crime and environmental protection.

Ethics concerns the principles used to determine what ought to be done. Ethical conduct may require more than legal compliance. For example, a firm may lawfully exploit an information asymmetry while still violating principles of fairness, transparency or respect for vulnerable stakeholders.

Enterprise risk management (ERM) is the coordinated process through which an organization identifies, assesses, responds to and monitors risks that may affect its objectives. Compliance risk is one category within a wider risk universe that also includes strategic, financial, operational, cyber, reputational, climate and third-party risks.

Sustainability governance concerns the structures and decisions through which an enterprise manages its long-term environmental, social and economic impacts and dependencies. ESG—environmental, social and governance—provides a common organizing language, although ESG factors are not themselves a complete theory of corporate responsibility.

These concepts overlap but should not be collapsed into one another. A compliance officer cannot resolve every ethical question, and a sustainability report cannot substitute for effective internal controls. Sound governance clarifies their relationships while coordinating them.

1.2 The three lines model and board accountability

A practical governance architecture commonly distinguishes three organizational roles:

The model is not a substitute for accountability. The board remains responsible for oversight, risk appetite, integrity of reporting and senior-management accountability. Management is responsible for implementing systems. Internal audit should not operate controls that it later evaluates, because that compromises independence.

Board oversight is strongest when directors receive information that is timely, decision-useful and sufficiently specific. Aggregate statements such as “compliance is satisfactory” are weak unless supported by indicators, incidents, trends, unresolved investigations, control deficiencies and management actions.

2. Building a Risk-Based Compliance System

2.1 Risk assessment as the starting point

A compliance program should begin with a structured risk assessment rather than a catalogue of policies. The assessment considers:

• applicable laws and regulatory expectations;
• products, services and business models;
• geographical exposure and high-risk jurisdictions;
• customers, suppliers, agents and other intermediaries;
• transaction types, payment methods and unusual activity;
• prior incidents, complaints, audit findings and enforcement actions;
• organizational incentives, remuneration and management behavior; and
• emerging threats, including cyber-enabled fraud, artificial intelligence and climate-related disruption.

A useful qualitative assessment considers likelihood, impact, velocity and control effectiveness. Likelihood concerns the chance that an event will occur; impact concerns the magnitude of consequences; velocity concerns how quickly consequences materialize; and control effectiveness concerns the extent to which existing controls prevent or detect the event.

A simple prioritization score may be used for internal triage:

Each factor must be defined on a consistent scale, such as 1 to 5. The score is not a probability and should not be presented as a precise prediction. It is a decision aid. Organizations should avoid false precision and supplement scoring with judgment, scenario analysis and qualitative evidence.

The assessment should produce a risk register identifying risk owners, existing controls, residual exposure, planned actions, deadlines and escalation thresholds. It should be refreshed when the organization enters a new market, introduces a product, acquires another business, changes a distributor or encounters a material incident.

2.2 Core components of a compliance program

A mature program normally contains the following components:

1. Leadership and culture. Senior leaders communicate that revenue, growth and operational targets do not justify unlawful or unethical conduct. Incentives should reward responsible performance, not only short-term results.
2. Policies and procedures. Policies translate principles into operational requirements, approval thresholds, prohibited conduct, documentation standards and escalation routes.
3. Training and communication. Training should be role-specific, scenario-based and reinforced by management behavior. A generic annual presentation rarely changes conduct by itself.
4. Advice and support. Employees need accessible guidance before a problem becomes an incident. Compliance advice should be practical and sufficiently independent.
5. Controls and monitoring. Preventive and detective controls should address identified risks and generate reliable evidence of operation.
6. Reporting and investigations. People must be able to report concerns confidentially or anonymously where permitted, without retaliation.
7. Discipline and incentives. Misconduct should produce proportionate and consistent consequences, including for high performers and managers.
8. Remediation and continuous improvement. Root-cause analysis should address incentives, processes, systems and supervision rather than blaming a single individual.
9. Independent assurance. Internal audit, external assurance and board review should test whether the program works in practice.

2.3 Codes of conduct

A code of conduct is the organization’s central statement of expected behavior. It should cover conflicts of interest, gifts and hospitality, fair dealing, competition, use of information, human rights, workplace conduct, confidentiality, records, speaking up and environmental responsibilities. It should identify who must comply, including directors, employees, temporary workers and, where appropriate, business partners.

A code is effective when it is understandable, accessible and connected to actual decisions. It should include examples: a payment to accelerate a routine government service, a supplier offering expensive hospitality during a tender, or a manager pressuring an employee not to report an incident. It should also explain how to obtain advice and how concerns are handled.

A code cannot replace judgment. Detailed rules may be incomplete, conflict with one another or fail to anticipate new technology. Ethical reasoning helps managers ask whether conduct is lawful, honest, fair, respectful, sustainable and defensible if publicly disclosed.

3. Controls, Reporting and Investigations

3.1 Preventive and detective controls

Preventive controls seek to stop an event before it occurs. Examples include segregation of duties, approval requirements, due diligence, access restrictions, payment limits and conflict declarations. Detective controls identify conduct after or during occurrence. Examples include reconciliations, transaction monitoring, hotline analytics, data testing and internal audit.

Controls should be designed around specific risks. A control is not effective merely because a policy exists. Management should ask:

• What risk does the control address?
• Who performs it, and do they possess sufficient authority and competence?
• What evidence demonstrates performance?
• Can the control be bypassed by senior personnel or collusion?
• Is it proportionate to the risk?
• How is effectiveness tested?

A control matrix can connect risks to control owners, frequency, evidence and testing results. Excessive controls may create bureaucracy and encourage workarounds; insufficient controls may leave material exposure unmanaged.

3.2 Reporting channels and non-retaliation

Reporting channels may include line management, compliance officers, ombuds services, web portals, telephone hotlines and external reporting routes required by law. Multiple channels are important because employees differ in trust, language, accessibility and perceived independence.

A credible system requires confidentiality protections, clear triage, documented case management and a prohibition on retaliation. Confidentiality cannot always be guaranteed, particularly where disclosure is legally required or necessary for a fair investigation. Organizations should communicate this honestly rather than promise absolute secrecy.

Metrics should go beyond the number of reports. A low reporting rate may indicate ethical health, but it may also reflect fear, inaccessibility or distrust. Useful indicators include awareness, accessibility, substantiation rates, investigation duration, retaliation allegations, repeat issues and remediation completion.

3.3 Investigations and due process

An investigation should be authorized, scoped and conducted by competent personnel with appropriate independence. The process generally includes:

1. intake and preliminary assessment;
2. preservation of relevant documents and data;
3. conflict-of-interest checks;
4. investigation plan and evidence collection;
5. interviews conducted fairly and respectfully;
6. analysis of facts against applicable standards;
7. documented findings and escalation;
8. disciplinary, legal or regulatory decisions; and
9. remediation, lessons learned and closure.

Investigations must respect employment law, privacy, legal privilege and data-transfer requirements. A company should avoid both premature conclusions and indefinite delay. Findings should distinguish established facts, reasonable inferences and unresolved allegations. The objective is not merely to identify a wrongdoer; it is to determine how the event occurred and whether the system failed.

4. Anti-Money Laundering and Anti-Corruption

4.1 Anti-money laundering

Money laundering is commonly described through three overlapping stages: placement, introducing illicit proceeds into the financial system; layering, separating proceeds from their source through complex transactions; and integration, making funds appear legitimate. The stages are analytical rather than mandatory: not every scheme contains all three.

An anti-money-laundering (AML) program generally includes customer identification and verification, beneficial-ownership analysis, customer risk classification, enhanced due diligence for higher-risk relationships, transaction monitoring, recordkeeping, employee training and suspicious-activity reporting where required. Customer due diligence should be continuous rather than a one-time onboarding exercise.

Red flags may include transactions inconsistent with a customer’s profile, opaque ownership structures, unexplained use of intermediaries, rapid movement of funds, unusual cash activity, transactions involving high-risk jurisdictions or reluctance to provide information. A red flag is not proof of wrongdoing; it indicates a need for investigation and documented judgment.

4.2 Anti-corruption controls

Anti-corruption systems address bribery of public officials and, in many legal regimes, commercial bribery and related misconduct. Risk rises where a company uses agents, operates in sectors requiring licenses, depends heavily on government contracts or works in jurisdictions with weak enforcement.

Core controls include:

• risk-based third-party due diligence;
• written contracts describing legitimate services;
• verification of services and invoices;
• reasonable, documented remuneration;
• approval and recording of gifts, travel, charitable contributions and sponsorships;
• controls over facilitation payments and political contributions;
• accurate books and records; and
• periodic testing of high-risk transactions.

Third parties are a frequent source of exposure. A company cannot transfer its compliance responsibility simply by outsourcing an activity. Due diligence should examine ownership, reputation, qualifications, conflicts, government connections, compensation and the commercial rationale for engagement. Contractual audit rights and termination provisions are useful but cannot replace actual monitoring.

5. Regulatory Engagement and Enforcement Readiness

Regulatory engagement should be accurate, timely, respectful and controlled. Organizations need protocols for responding to inspections, information requests, subpoenas, supervisory meetings and voluntary disclosures. Relevant documents should be preserved, records should not be altered, and communications should be coordinated without misleading the authority.

A constructive regulatory relationship is not the same as regulatory capture or informal favoritism. Engagement should be transparent, documented and consistent with applicable lobbying, procurement and conflict-of-interest rules. Senior managers should understand that inaccurate statements to a regulator can create a separate and serious violation.

Enforcement risk is affected not only by the underlying misconduct but also by the quality of the organization’s response. Authorities often examine whether the company had a credible program, whether it detected the issue promptly, whether it investigated independently, whether it self-reported where appropriate and whether it remediated root causes. Legal advice is essential because disclosure duties, privilege and cooperation expectations vary by jurisdiction.

6. Ethical Reasoning and Corporate Decision-Making

Ethical reasoning provides a disciplined method for analyzing difficult decisions. Four perspectives are especially useful:

• Consequential reasoning: evaluates foreseeable benefits, harms and distributional effects.
• Rights-based reasoning: asks whether conduct respects autonomy, privacy, dignity and other protected interests.
• Justice and fairness: examines whether burdens and benefits are allocated fairly and whether procedures are impartial.
• Virtue and character: considers what a trustworthy, responsible organization would do and what habits the decision reinforces.

These perspectives can conflict. A cost-saving decision may benefit most customers but impose serious harm on a vulnerable minority. Ethical analysis should therefore identify affected stakeholders, relevant duties, alternatives, uncertainties and mechanisms for accountability. A decision memo can require managers to state the legal position, ethical concerns, affected stakeholders, evidence, mitigation and escalation route.

Ethical culture is shaped by systems as much as by personal values. Unrealistic sales targets, opaque promotion criteria, retaliation against dissent and bonuses based solely on volume can normalize misconduct. Conversely, psychological safety, fair investigations and visible accountability support responsible behavior.

7. ESG, Sustainability and Human Rights

7.1 ESG as a governance issue

Environmental issues include climate change, pollution, biodiversity, resource use and waste. Social issues include labor conditions, health and safety, diversity, privacy, community impacts and human rights. Governance includes board accountability, corruption prevention, executive remuneration, tax conduct, shareholder rights and quality of disclosure.

ESG analysis should distinguish inside-out impacts—how the enterprise affects people and the environment—from outside-in risks—how sustainability conditions affect enterprise value, cash flows, assets and strategy. A company may have low immediate financial exposure while causing significant social or environmental harm. Good governance considers both dimensions where relevant.

7.2 Human rights due diligence

Human rights due diligence is a continuous process of identifying, preventing, mitigating and accounting for adverse impacts. It should cover operations, subsidiaries, contractors and supply chains, with attention to vulnerable groups and the possibility of severe impacts.

A robust process includes stakeholder consultation, risk prioritization, contractual and operational controls, grievance mechanisms, remediation and public reporting. Audits alone are insufficient: suppliers may conceal conditions during scheduled visits, and workers may fear speaking openly. Effective programs combine audits with worker voice, purchasing-practice review and credible remediation.

The organization should distinguish responsibility from influence. It may not control an independent supplier, but its purchasing terms, deadlines and pricing can contribute to labor abuses. Responsible procurement therefore forms part of human-rights governance.

7.3 Climate risk

Climate risk is commonly divided into:

• Physical risk: damage or disruption from acute events such as floods and storms, and chronic changes such as heat and water scarcity.
• Transition risk: losses arising from policy, technology, market preference, litigation or reputational change during movement toward a lower-emission economy.
• Opportunity: potential gains from resilient infrastructure, new products, efficiency and clean technologies.

Boards should consider climate risk in strategy, capital allocation, insurance, supply-chain resilience, scenario analysis and disclosure. Scenario analysis explores how outcomes may differ under alternative assumptions; it is not a forecast and should not be presented as one. Assumptions about policy, technology, demand and physical hazards must be transparent.

7.4 Sustainability disclosure and greenwashing

Sustainability disclosure should be decision-useful, balanced, comparable and supported by evidence. Material claims require defined boundaries, reliable data, consistent methodologies and governance over measurement. Organizations should explain estimates, limitations, restatements and progress against targets.

Greenwashing occurs when environmental or sustainability communications create a materially misleading impression, including through exaggeration, selective disclosure, vague language or unsupported future commitments. Common warning signs include:

• absolute claims such as “zero impact” without credible boundaries;
• reliance on a small offsetting activity to imply a fully sustainable product;
• targets without baselines, milestones, resources or accountability;
• highlighting favorable indicators while omitting material adverse impacts; and
• using labels or imagery that imply certification without independent substantiation.

A claim-governance process should require legal, technical and sustainability review before publication. Marketing claims should align with operational reality, product life-cycle evidence and applicable consumer-protection rules. Independent assurance can improve reliability, but assurance does not cure a poorly defined claim.

8. Integrating Enterprise Risk and Sustainability

Integration requires common taxonomies, shared data, clear ownership and escalation. Compliance risk, cyber risk, climate risk and human-rights risk may interact. For example, a transition to a new supplier may reduce emissions but increase labor risk; a climate event may disrupt a supplier and create bribery pressure during emergency procurement.

A board dashboard should combine leading and lagging indicators. Leading indicators include training completion, overdue due diligence, control-testing exceptions, unresolved grievances and supplier-risk reviews. Lagging indicators include enforcement actions, injuries, confirmed misconduct, emissions performance and financial losses. Indicators should be linked to thresholds that trigger action rather than merely decorate reports.

Technology can support screening, anomaly detection, document review and emissions-data management. Artificial intelligence, however, introduces risks of bias, false positives, opaque decision-making, privacy violations and overreliance on automated outputs. Human review, model validation, access controls, audit trails and appeal mechanisms are necessary when technology influences investigations, customer classification or employment decisions.

9. Illustrative Case: Meridian Components Ltd.

Background

Meridian Components Ltd., a fictional manufacturer, supplies equipment to public infrastructure projects in three countries. It has recently acquired a distributor whose sales depend on local agents. Meridian announces a target to reduce operational emissions by 40 percent within five years and publishes a statement describing its supply chain as “responsible and low impact.”

Problem

An internal hotline receives an anonymous allegation that an agent has paid officials to accelerate customs clearance. At the same time, a supplier audit identifies excessive working hours, while procurement records show that the supplier was selected partly because it offered the lowest price. The sustainability team lacks reliable data for upstream emissions, and marketing has used the “low-impact” description without a defined methodology.

Analysis

The issues are interconnected. The agent creates anti-corruption and third-party risk. The supplier findings create human-rights and operational risks. Weak emissions data creates disclosure and greenwashing risk. The acquisition creates integration risk because Meridian’s controls may not operate effectively in the distributor.

The board should not treat the hotline allegation as an isolated employee matter. It should ask whether due diligence was performed, whether payments were properly recorded, whether senior personnel pressured the agent, and whether the distributor’s incentive system encouraged improper acceleration. It should also examine whether purchasing practices contributed to labor abuses and whether the climate target includes a transparent boundary and credible baseline.

Approach and solution

Meridian should preserve relevant records, appoint an independent investigation team and suspend or restrict the agent relationship pending fact-finding, subject to legal advice. It should assess reporting obligations and avoid destroying or altering records. The distributor should undergo a focused compliance review and receive role-specific training.

For the supplier, Meridian should conduct worker-informed due diligence, establish a corrective-action plan and review whether its own prices and delivery deadlines contribute to excessive hours. Immediate remediation should address serious safety or coercion risks; termination should not be automatic if continued engagement enables effective remediation, although severe or unremedied abuse may require disengagement.

For sustainability communications, Meridian should withdraw or qualify the unsupported “low-impact” claim, define the emissions boundary, establish data controls and publish measurable milestones. The audit committee should receive a consolidated report showing misconduct findings, human-rights impacts, emissions-data limitations and remediation owners.

Outcome

In this illustrative scenario, the investigation confirms improper payments by the agent but finds no evidence that the board knew of them. Meridian self-reports where legally appropriate, terminates the agent after considering continuity risks, strengthens third-party controls and revises sales incentives. The supplier implements a monitored remediation plan, and Meridian changes procurement timelines and pricing practices. The company replaces the broad marketing claim with a qualified statement supported by measured data and obtains independent review of selected indicators.

Learning points

1. Risk is often concentrated at organizational boundaries: agents, suppliers, acquisitions and marketing claims.
2. A hotline is valuable only when reports lead to independent investigation and remediation.
3. Sustainability performance depends on commercial practices, not merely public commitments.
4. Disclosure governance must be integrated with operational evidence and legal review.
5. Boards need cross-functional information rather than separate compliance, procurement and ESG narratives.

10. Challenges, Limitations and Best Practices

Risk-based systems involve judgment and cannot eliminate misconduct. Risk scores may conceal uncertainty, controls may be bypassed through collusion, and audits may miss hidden conditions. Global organizations face conflicting laws concerning privacy, whistleblowing, data transfer and disclosure. Small firms may lack specialist personnel, while large firms may create fragmented responsibility.

Best practice is therefore adaptive rather than purely formal. Organizations should:

• align risk assessment with strategy and changing exposure;
• give compliance sufficient independence, resources and access to the board;
• test controls in operation, not merely inspect policy documents;
• protect reporters and investigate allegations impartially;
• apply discipline consistently, including to senior employees;
• use third-party and supply-chain oversight proportionate to risk;
• maintain evidence for sustainability claims and targets;
• connect incentives to ethical and sustainable performance;
• use technology with human oversight and documented accountability; and
• treat incidents as opportunities for organizational learning.

The ultimate test is not the volume of policies but whether the enterprise makes better decisions under pressure, detects problems early, protects affected stakeholders and can explain its conduct credibly to regulators, investors, employees and communities.

Chapter Summary

Compliance, ethics, sustainability and enterprise risk form a connected governance system. Compliance establishes legal and policy requirements, ethics supports judgment where rules are incomplete, sustainability addresses long-term impacts and dependencies, and ERM integrates uncertainty into strategy. A risk-based compliance program begins with a structured assessment and includes leadership, policies, training, controls, reporting, investigations, discipline, remediation and assurance.

Effective governance requires functioning first-line ownership, second-line challenge and third-line independent assurance. AML and anti-corruption programs depend on risk-based due diligence, beneficial-ownership analysis, transaction monitoring, accurate records and oversight of intermediaries. Reporting channels must be accessible and protected from retaliation, while investigations must respect independence, fairness, privacy and legal requirements.

ESG governance should address both the enterprise’s impacts on stakeholders and the effects of sustainability conditions on enterprise value. Human-rights due diligence, climate-risk analysis and reliable sustainability disclosure are strategic governance responsibilities. Greenwashing is prevented through defined claims, evidence, transparent boundaries, credible targets and review controls. Technology can improve monitoring but requires human oversight, validation and accountability.

Key Terms

Compliance: Adherence to applicable law, regulation, contracts and internal requirements.

Ethics: Principles used to evaluate what ought to be done, including fairness, dignity and responsibility.

Enterprise risk management: Coordinated identification, assessment, response and monitoring of risks affecting objectives.

Risk appetite: The amount and type of risk an organization is willing to accept in pursuit of objectives.

Compliance risk: The risk of legal, regulatory, financial or reputational consequences from non-compliance.

Code of conduct: A formal statement of expected organizational behavior.

Internal control: A process designed to prevent, detect or correct errors, misconduct or other risks.

Three lines model: A governance model distinguishing operational ownership, risk/compliance oversight and independent audit assurance.

Whistleblowing: Reporting suspected wrongdoing through internal or external channels.

Retaliation: Adverse treatment imposed because a person reported a concern or participated in an investigation.

Money laundering: Concealing or disguising the illicit origin of assets.

Beneficial owner: The natural person who ultimately owns or controls an entity or arrangement.

Bribery: Offering, giving, requesting or receiving an undue advantage to influence conduct.

ESG: Environmental, social and governance factors relevant to organizational impacts and performance.

Human-rights due diligence: A continuing process of identifying, preventing, mitigating and accounting for human-rights impacts.

Physical climate risk: Risk from acute or chronic physical effects of climate change.

Transition risk: Risk arising from changes associated with movement toward a lower-emission economy.

Greenwashing: Misleading presentation of environmental or sustainability performance.

Scenario analysis: Examination of possible outcomes under alternative assumptions, not a precise forecast.

Regulatory engagement: Structured interaction with supervisory or enforcement authorities.

Review Questions

Short Answer Questions

1. How do compliance and ethics differ, and why does an organization need both?
2. What are the three lines in the three lines model?
3. Identify three components of an effective AML program.
4. What is the difference between physical climate risk and transition risk?
5. Why is a low number of hotline reports not necessarily evidence of an ethical culture?

Long Answer Questions

1. Explain how a company can design and implement a risk-based compliance program. Discuss risk assessment, controls, training, reporting, investigations and assurance.
2. Analyze the role of the board in integrating compliance, ethics, sustainability and enterprise risk management.
3. Discuss the principal governance challenges associated with third-party intermediaries and supply chains.
4. Explain how human-rights due diligence differs from a conventional supplier audit and why the distinction matters.
5. Evaluate the causes of greenwashing and propose a governance process for preventing misleading sustainability claims.

Analytical / Application Questions

1. A company’s sales team engages an agent in a high-risk jurisdiction and offers bonuses based solely on speed of contract completion. Design a risk assessment and identify preventive and detective controls.
2. A manufacturer claims that a product is “carbon neutral,” but the claim relies entirely on purchased offsets and excludes significant upstream emissions. Analyze the legal, ethical and governance issues and recommend corrective action.
3. Following a flood, a company’s emergency procurement team makes unusually large payments to a newly formed supplier connected to a local official. Explain how AML, anti-corruption, climate-risk and investigation procedures should interact.

Multiple Choice Questions with Answers

Question 1

Which statement best describes a risk-based compliance system?

A. It applies identical controls to every activity regardless of exposure.

B. It directs greater resources toward activities and relationships presenting higher risk.

C. It focuses exclusively on responding after regulators impose penalties.

D. It transfers all compliance responsibility to the legal department.

Correct Answer: B. It directs greater resources toward activities and relationships presenting higher risk.

Question 2

Which organizational function provides independent, risk-based assurance in the three lines model?

A. Business operations

B. The procurement department

C. Internal audit

D. External marketing

Correct Answer: C. Internal audit

Question 3

Which is an example of a preventive control?

A. A post-incident investigation

B. A completed internal-audit report

C. A transaction-approval requirement before payment

D. A customer complaint after delivery

Correct Answer: C. A transaction-approval requirement before payment

Question 4

What is the principal purpose of beneficial-ownership analysis in AML compliance?

A. To identify the natural persons who ultimately own or control an entity

B. To determine the entity’s advertising budget

C. To calculate employee turnover

D. To replace all transaction monitoring

Correct Answer: A. To identify the natural persons who ultimately own or control an entity

Question 5

Which practice most directly reduces anti-corruption risk involving third parties?

A. Paying commissions without documentation

B. Using written contracts, due diligence and verification of services

C. Allowing agents to approve their own invoices

D. Exempting high-performing agents from review

Correct Answer: B. Using written contracts, due diligence and verification of services

Question 6

Which statement best distinguishes physical climate risk from transition risk?

A. Physical risk concerns regulation, while transition risk concerns storms.

B. Physical risk concerns climate impacts, while transition risk concerns changes during movement to a lower-emission economy.

C. Physical risk applies only to insurers, while transition risk applies only to manufacturers.

D. There is no meaningful distinction between them.

Correct Answer: B. Physical risk concerns climate impacts, while transition risk concerns changes during movement to a lower-emission economy.

Question 7

Which feature is most likely to indicate greenwashing?

A. A claim with a defined boundary, baseline and supporting evidence

B. A target with milestones, resources and assigned accountability

C. An absolute environmental claim that lacks a credible methodology

D. Disclosure of data limitations and estimation methods

Correct Answer: C. An absolute environmental claim that lacks a credible methodology

Question 8

Why should an organization analyze its own purchasing practices during human-rights due diligence?

A. Purchasing terms and deadlines may contribute to supplier labor abuses.

B. Purchasing practices are unrelated to supply-chain conditions.

C. It allows the organization to avoid consulting workers.

D. It replaces the need for any supplier monitoring.

Correct Answer: A. Purchasing terms and deadlines may contribute to supplier labor abuses.

Question 9

Which response is most appropriate when a hotline allegation is received?

A. Delete potentially sensitive records immediately.

B. Announce the identity of the reporter to all employees.

C. Preserve relevant information, assess conflicts and conduct a fair investigation.

D. Dismiss the allegation if the accused is a high-performing employee.

Correct Answer: C. Preserve relevant information, assess conflicts and conduct a fair investigation.

Question 10

Why is scenario analysis used in climate-risk governance?

A. It provides a guaranteed prediction of future climate outcomes.

B. It explores possible outcomes under alternative assumptions.

C. It eliminates the need for board oversight.

D. It proves that a sustainability target has already been achieved.

Correct Answer: B. It explores possible outcomes under alternative assumptions.