Compliance Governance and Strategic Legal-Risk Management

Introduction

Logistics organisations operate through a dense network of contracts, licences, customs procedures, employment relationships, safety obligations, data exchanges, environmental requirements and third-party arrangements. A legal failure may therefore arise from a warehouse practice, a transport subcontractor, a sanctions-screening gap, a misclassified worker, an inaccurate customs declaration or a poorly drafted service-level agreement. The resulting consequences can include fines, cargo seizure, licence suspension, litigation, supply interruption, loss of insurance cover, reputational damage and personal liability for directors or managers.

Compliance governance is the system through which an organisation identifies legal obligations, assigns accountability, designs controls, monitors performance, responds to deviations and reports to governing bodies. Strategic legal-risk management goes further than preventing isolated violations. It connects legal risk with commercial strategy, resilience, procurement, technology, reputation and enterprise risk management.

This chapter presents a practical framework for logistics managers and legal professionals. It treats compliance as a continuous management capability rather than a static collection of policies. Because laws differ by jurisdiction, the frameworks described here must be adapted to applicable legislation, regulatory guidance, licences, industry codes and contractual commitments.

Learning objectives

By the end of this chapter, the reader should be able to:

1. Explain the relationship between legal risk, compliance governance and logistics strategy.
2. Construct a legal-obligation inventory, audit programme, control matrix and risk register.
3. Use key risk indicators, contract analytics, due diligence and scenario analysis responsibly.
4. Design effective training, whistleblowing, investigation and remediation arrangements.
5. Evaluate a logistics compliance case and make a defensible managerial decision.
6. Assess the roles of senior management, the board, internal audit and operational personnel.

1. Legal risk in the logistics enterprise

1.1 Meaning and sources

Legal risk is the possibility that an organisation suffers loss or disadvantage because of law, regulation, contract, dispute, enforcement action or a failure to protect its legal rights. It includes both direct consequences, such as a penalty, and indirect consequences, such as the loss of a major customer after a compliance incident.

Important sources include:

• transport, carriage and freight-forwarding law;
• customs, export-control, sanctions and trade-compliance rules;
• occupational health and safety requirements;
• environmental, dangerous-goods and waste regulations;
• employment, agency and modern-slavery obligations;
• competition, anti-bribery and anti-corruption law;
• data protection, cybersecurity and electronic-transactions law;
• insurance requirements and limitations;
• leases, licences, concessions and public procurement rules; and
• commercial contracts with shippers, carriers, platforms and suppliers.

A logistics organisation may be compliant with one body of law and still breach another. For example, a delivery optimisation system may reduce fuel consumption but unlawfully process driver location data. A low-cost subcontractor may improve margins but create exposure to unsafe work, forced labour or sanctions violations.

1.2 Legal risk versus compliance risk

Compliance risk concerns failure to comply with applicable obligations. Legal risk is broader: it includes uncertainty in interpreting law, defective contracts, unenforceable clauses, litigation strategy, intellectual-property disputes and the inability to exercise a legal remedy. Compliance is therefore one component of legal-risk management, not its complete equivalent.

A useful governance distinction is:

• Obligation: what the law, regulator, licence or contract requires.
• Risk: what may prevent the organisation from meeting the obligation or protecting its position.
• Control: a measure designed to prevent, detect or correct the risk.
• Evidence: records demonstrating that the control operated.
• Assurance: an independent or sufficiently objective evaluation of design and performance.

1.3 Governance principles

Effective compliance governance rests on five principles.

Accountability. A named executive owns each material obligation. “The legal department” cannot be the sole owner of operational compliance.

Proportionality. Controls should reflect the seriousness, probability, velocity and reversibility of a risk. A high-risk export transaction requires stronger controls than a low-risk stationery purchase.

Independence. Monitoring and investigations must be sufficiently independent from the personnel whose performance is being assessed.

Evidence. A policy is not proof of compliance. The organisation should retain reliable evidence that controls were performed, exceptions were addressed and decisions were authorised.

Continuous improvement. Incidents, near misses, regulatory changes, audit findings and employee reports should modify the control environment.

2. Building a compliance governance framework

2.1 The obligation universe

The first task is to identify the organisation’s “obligation universe”. This is a structured inventory of external and internal requirements. Each entry should state the source, jurisdiction, regulated activity, responsible owner, applicability conditions, evidence requirement, review date and consequence of non-compliance.

A useful process is:

1. map entities, facilities, routes, services and third parties;
2. identify licences, permits, registrations and operating approvals;
3. collect applicable legislation, regulatory guidance and contractual duties;
4. translate legal language into operational requirements;
5. assign owners and evidence standards; and
6. review the inventory whenever the organisation enters a new market, acquires a business, changes technology or adopts a new service.

Legal counsel should explain interpretation and uncertainty, while operational owners should validate whether a requirement can actually be performed in the field.

2.2 The three-lines model

A practical allocation of responsibility is the three-lines model:

The board and senior executives sit above these lines as governing and oversight bodies. The model is not a substitute for management accountability. Compliance cannot “own” a warehouse manager’s operational duty merely because it designed a checklist.

2.3 Board and executive oversight

The board should approve the compliance strategy, risk appetite, material policies and escalation thresholds. It should receive information that permits challenge, including significant incidents, overdue remediation, whistleblowing trends, regulatory changes, third-party exposure and resource constraints.

Useful board reporting distinguishes:

• inherent risk before controls;
• residual risk after controls;
• risk accepted by an authorised person;
• risk outside approved tolerance; and
• emerging risk for which evidence is incomplete.

A dashboard containing only green indicators is not necessarily good news. It may indicate weak measurement, under-reporting or excessive aggregation. Directors should ask whether the data is complete, whether incentives discourage reporting and whether controls are effective in practice rather than merely documented.

3. Legal audits and control design

3.1 The legal audit cycle

A legal audit is a structured examination of legal obligations, controls, records and actual practices. It is not limited to checking whether a policy exists. A robust cycle includes planning, scoping, evidence collection, testing, evaluation, reporting and follow-up.

Planning and scoping. Define the business unit, jurisdictions, period, criteria and materiality. A warehouse audit may cover dangerous goods, employment, security, data and environmental issues, while a cross-border transport audit may emphasise customs, sanctions and import documentation.

Evidence collection. Review licences, contracts, training records, inspection reports, incident files, system logs, payroll information, customs declarations, carrier files and complaints. Interviews and site observations are essential because written procedures may not reflect actual work.

Testing. Test both design and operating effectiveness. Design testing asks whether the control could prevent or detect the risk. Operating testing asks whether it operated consistently during the relevant period.

Reporting. Findings should identify the criterion, condition, cause, consequence, owner, deadline and required corrective action. A vague finding such as “improve compliance” is not actionable.

Follow-up. Closure requires evidence, not a management promise. An overdue action should be escalated according to its severity.

3.2 The control matrix

A control matrix links obligations to risks, controls, owners and evidence.

Controls may be preventive, detective or corrective. Segregation of duties, approval limits and system blocks are preventive. Reconciliations, exception reports and audits are detective. Incident response, contract termination and remediation are corrective. A mature framework combines all three.

3.3 Control effectiveness

Control evaluation should consider whether a control is suitably designed, consistently performed, supported by competent people and capable of producing reliable evidence. Automated controls can be powerful, but they are not automatically effective. Incorrect master data, poorly configured rules or unauthorised overrides can create systematic failure.

A control owner should document exceptions rather than silently bypassing a control to meet a delivery target. Repeated exceptions are evidence that the process, resourcing or risk appetite may need redesign.

4. Risk registers, scoring and key risk indicators

4.1 Constructing a risk register

A risk register is a decision tool, not a catalogue of fears. Each entry should state the risk event, causes, consequences, affected objectives, existing controls, inherent rating, residual rating, treatment, owner, due date and escalation status.

A concise risk statement follows this pattern:

Because of [cause], [event] may occur, resulting in [consequence] for [objective].

For example: “Because carrier licence data is maintained manually, an expired licence may be used, resulting in unlawful transport, shipment delay and insurance disputes.”

4.2 Risk scoring

Many organisations use a likelihood-impact matrix. A simple expected-loss model can support prioritisation:

Here, E(L) is expected loss, p is the estimated probability of the event during a defined period, and I is the monetary impact if it occurs. The units of E(L) are monetary units when I is monetary. The model assumes a sufficiently defined event, a meaningful probability estimate and an impact measure that is comparable across cases. It does not capture reputational persistence, legal uncertainty, correlated events or catastrophic outcomes well, so it must not replace judgement.

For example, if a documentation failure is estimated to have a 4% annual probability and a potential direct impact of $250,000, the expected direct loss is:

This result does not mean that the organisation should simply budget $10,000. A low-probability event may threaten a licence or cause serious harm, and the estimate may omit legal costs, customer loss and human consequences.

A risk register should record confidence in estimates. “Low confidence” is itself a reason to obtain better information or apply a precautionary control.

4.3 Key risk indicators

Key risk indicators (KRIs) are measurements that signal changing exposure. Examples include:

• percentage of carriers with licences expiring within 30 days;
• number and age of unresolved customs exceptions;
• proportion of high-risk suppliers lacking current due diligence;
• rate of manual overrides in sanctions screening;
• overdue corrective actions by severity;
• data-access anomalies;
• injury near misses per operating hours; and
• percentage of contracts lacking required indemnity or audit rights.

A KRI needs a definition, data source, owner, frequency, threshold and response. A threshold without a response is only a report. KRIs must be interpreted carefully: an increase in reported near misses may reflect better reporting rather than worse safety.

5. Contract analytics and third-party governance

5.1 Contracts as control instruments

Contracts allocate duties, evidence obligations, risk and remedies. In logistics, important clauses address service levels, cargo liability, insurance, subcontracting, regulatory compliance, sanctions, audit rights, data security, business continuity, indemnities, limitation of liability, change control and termination.

Contract analytics can identify missing or inconsistent provisions across a contract portfolio. It may classify clauses, compare liability caps, identify renewal dates and detect deviations from approved positions. However, automated extraction is probabilistic and should not be treated as legal advice without human review. A clause may be present but commercially ineffective because it conflicts with governing law, mandatory carriage conventions or another provision.

A contract-risk dashboard might show:

5.2 Due diligence and ongoing monitoring

Third-party risk is not solved by collecting a questionnaire. Proportionate due diligence should consider ownership and control, beneficial owners, sanctions and adverse media where lawful, licences, financial stability, safety record, labour practices, corruption exposure, data practices and the actual service to be performed.

The process should be risk-based. A local supplier providing non-critical packaging may require basic checks, whereas a customs broker, security provider or agent in a high-risk jurisdiction may require enhanced review, contractual protections and periodic re-screening.

Red flags include refusal to disclose ownership, unusual payment requests, unexplained intermediaries, pressure to bypass procedures, inconsistent corporate information, excessive commissions and reluctance to permit audits. A red flag is not proof of misconduct, but it requires documented investigation and a reasoned decision.

6. Scenario analysis and strategic decision-making

Historical incidents cannot reveal every future exposure. Scenario analysis asks what would happen under plausible adverse conditions and whether the organisation can respond.

Relevant scenarios include:

• a sanctions designation affecting a major carrier or customer;
• a cyberattack that disables warehouse-management systems;
• a serious injury involving a subcontractor;
• customs detention of high-value inventory;
• a whistleblower allegation against a senior manager;
• a climate event closing a port or distribution centre; and
• a regulator discovering repeated false records.

A scenario workshop should define assumptions, dependencies, decision points, legal duties, communications, available data and recovery objectives. Participants should include operations, legal, compliance, procurement, IT, finance, insurance, communications and, where relevant, external specialists.

Scenario analysis is especially valuable for legal risk because consequences may unfold in stages: an incident, preservation of evidence, notification, regulator engagement, customer claims, insurance coverage and remediation. Managers should identify who has authority to stop shipments, preserve records, notify authorities and communicate with customers.

7. Training, speak-up systems and investigations

7.1 Effective training

Training should be role-specific, practical and refreshed when risk changes. A driver needs guidance on roadside inspections, safety and reporting; a customs specialist needs classification and origin training; a procurement officer needs third-party and anti-bribery controls; a manager needs escalation and non-retaliation duties.

Completion rates are weak evidence of effectiveness. Better measures include scenario assessments, observed behaviour, quality of records, reduction in repeat findings and employee confidence in escalation channels.

7.2 Whistleblowing and speak-up culture

A credible reporting system offers accessible channels, confidentiality to the extent legally possible, non-retaliation, impartial triage, documented investigation and feedback consistent with privacy and due-process constraints. Channels should be available to employees, contractors and other relevant stakeholders.

Confidentiality is not the same as absolute secrecy. Investigators may need to disclose information to protect people, meet legal obligations or provide procedural fairness. Organisations should avoid promising more than they can lawfully deliver.

7.3 Investigations and remediation

An investigation should define the allegation, preserve relevant records, identify conflicts, establish a proportionate plan and document findings based on evidence. Legal privilege, where available, must be handled carefully; labelling every investigation “privileged” does not create privilege.

Remediation may include process redesign, repayment, customer notification, disciplinary action, self-reporting, contract review, training and independent assurance. The objective is not merely to identify an individual at fault. It is to determine why the system permitted the conduct and whether incentives or leadership contributed.

8. Technology, data and artificial intelligence

Digital logistics systems create compliance capability and new legal risk. Sensors, telematics, warehouse automation, digital freight platforms and predictive analytics generate records that can support traceability. They also raise questions about privacy, cybersecurity, data ownership, cross-border transfers, automated decisions and system reliability.

AI-assisted compliance tools can screen documents, detect anomalies, summarise contracts and prioritise audits. Their use should be governed by:

• defined purpose and approved use cases;
• reliable and appropriately sourced data;
• human review for material decisions;
• testing for error and bias;
• access controls and audit trails;
• protection of confidential and personal information; and
• a process to challenge, correct and override outputs.

An AI system may produce a plausible but incorrect classification or miss a newly designated entity. Accountability remains with the organisation and the authorised decision-maker. Managers should retain the evidence and reasoning behind high-consequence decisions rather than relying on an unreviewed system output.

9. Illustrative case: NorthStar Freight Services

The following is a fictional illustrative case.

Background

NorthStar Freight Services operates a regional distribution network and uses 180 subcontracted carriers. Its commercial strategy promises same-day delivery at prices below the market average. Carrier onboarding is managed by procurement, while compliance is a two-person central function. Licence expiry dates are stored in spreadsheets, and the transport-management system permits dispatch even when a carrier record is incomplete.

A new customer asks NorthStar to move controlled industrial equipment across three jurisdictions. The proposed carrier is commercially attractive but has a complex ownership structure, a licence expiring in six weeks and a subcontracting arrangement not yet disclosed. A sales executive argues that delay will lose the customer.

Problem

NorthStar must decide whether to accept the shipment while meeting delivery expectations. The legal issues include licensing, export restrictions, beneficial ownership, subcontracting, insurance, customs documentation, data sharing and possible personal accountability for approving a known exception.

Analysis

The risk is not simply “the carrier may be non-compliant.” A more precise statement is: because NorthStar has incomplete carrier and ownership information and weak system blocking, the shipment may be performed by an unauthorised or restricted party, causing detention, penalties, customer loss and insurance disputes.

The compliance team identifies the following red flags:

1. licence expiry is near the delivery period;
2. beneficial ownership is unclear;
3. subcontracting was not approved;
4. the system permits dispatch despite incomplete records; and
5. commercial pressure creates an incentive to bypass review.

The expected financial loss cannot be estimated confidently because the probability and consequences are uncertain. The uncertainty increases, rather than eliminates, the need for escalation.

Approach and decision

The chief operating officer pauses dispatch and informs the customer that verification is required. Procurement obtains current licence evidence, ownership information, insurance certificates and the subcontractor’s identity. Trade compliance conducts the required screening and reviews classification and export documentation. Legal reviews the governing contract, liability allocation and any mandatory regulatory requirements.

NorthStar then chooses one of two defensible outcomes: proceed only if all conditions are verified and documented, or use an approved alternative carrier. It does not rely on a sales waiver because commercial approval cannot override a legal prohibition. The board risk committee receives a report because the incident reveals a systemic control weakness.

NorthStar subsequently implements automated licence-expiry alerts, a dispatch block for incomplete high-risk records, beneficial-owner verification for designated carrier categories, approval of subcontractors, quarterly sampling and a KRI for manual overrides. It also revises incentive metrics so that delivery performance does not reward unlawful dispatch.

Outcome and learning points

The immediate shipment is delayed by one day but proceeds through a verified carrier. More importantly, NorthStar discovers that 14% of its carrier records lack current insurance evidence and that manual overrides were not being reported. The case demonstrates that a defensible decision considers legality, evidence, uncertainty, customer communication, alternatives and systemic remediation. “We have always used this carrier” is not a control, and “the customer demanded speed” is not a legal defence.

10. Challenges and limitations

Compliance frameworks can fail through complexity, duplication and false assurance. Excessive policies may encourage box-ticking. Excessive centralisation may distance compliance from operational reality. Excessive reliance on numerical scores may conceal catastrophic but infrequent events.

Cross-border logistics creates conflicts between legal systems, especially in data transfer, labour standards, sanctions, customs valuation and disclosure obligations. Organisations must obtain jurisdiction-specific advice rather than assuming that a home-country policy travels unchanged.

There is also an ethical risk in using compliance as a competitive weapon. A company should not impose unrealistic contractual requirements on small suppliers without providing reasonable implementation support, nor should it shift all responsibility to subcontractors while retaining operational control. Human rights, safety and environmental impacts should be treated as substantive concerns rather than reputation variables only.

A mature system recognises that controls reduce risk; they do not eliminate it. The appropriate managerial question is whether the remaining risk is understood, authorised, monitored and consistent with legal duties and organisational values.

Best-practice implementation roadmap

A logistics organisation beginning or renewing its programme can use the following sequence:

1. obtain board sponsorship and define accountability;
2. map legal obligations, entities, activities and jurisdictions;
3. identify material legal-risk scenarios;
4. build a risk-based control matrix and risk register;
5. strengthen high-risk contracts and third-party due diligence;
6. establish KRIs, escalation thresholds and reliable evidence repositories;
7. deliver role-specific training and accessible speak-up channels;
8. conduct audits and scenario exercises;
9. investigate incidents independently and track remediation; and
10. report trends and residual risk to the board, revising the framework as conditions change.

The quality of the programme should be judged by decisions and outcomes: whether people escalate concerns, whether the organisation can show what it did and why, whether controls operate under pressure and whether lessons produce measurable improvement.

Chapter Summary

Compliance governance integrates legal obligations, operational controls, accountability, assurance and board oversight. In logistics, legal risk arises across transport, customs, sanctions, safety, employment, data, environmental regulation, contracts and third-party relationships. A sound framework begins with an obligation universe and translates requirements into control matrices, evidence standards, risk registers and KRIs.

Legal audits must test both control design and actual operation. Risk scoring can support prioritisation but cannot replace judgement, particularly for uncertain or catastrophic events. Contracts allocate legal risk and should be analysed across the portfolio, while due diligence must be proportionate and continuous. Scenario analysis prepares the organisation for regulatory, operational and reputational shocks.

Training, whistleblowing, impartial investigations and remediation establish the behavioural foundations of compliance. Technology and AI can improve monitoring but require data governance, human accountability and validation. Finally, boards and executives must challenge optimistic reporting, approve risk appetite and ensure that commercial incentives do not reward unlawful conduct. Strategic legal-risk management is therefore a decision capability: it enables lawful growth, resilience and defensible managerial action.

Key Terms

Compliance governance: The structures and processes used to direct, monitor and assure compliance.

Legal risk: The possibility of loss arising from law, regulation, contract, dispute or failure to protect legal rights.

Obligation universe: The organised inventory of laws, regulations, licences, contracts and internal requirements applicable to an organisation.

Control: A preventive, detective or corrective measure addressing a risk.

Control matrix: A document linking obligations and risks to controls, owners, evidence and testing methods.

Legal audit: A structured review of legal requirements, practices, controls and evidence.

Risk register: A record of risks, causes, consequences, controls, ratings, owners and treatments.

Inherent risk: Exposure before considering existing controls.

Residual risk: Exposure remaining after controls operate.

Key risk indicator (KRI): A measure signalling changing risk exposure or control weakness.

Three-lines model: Allocation of risk ownership, oversight and independent assurance among management, specialist functions and internal audit.

Due diligence: Investigation undertaken to understand a person, entity, transaction or relationship before and during engagement.

Contract analytics: Systematic review of contract data and clauses to identify patterns, obligations and deviations.

Scenario analysis: Examination of plausible future events, consequences, dependencies and responses.

Whistleblowing: Reporting suspected wrongdoing through protected internal or external channels.

Remediation: Corrective action addressing an incident, control weakness or root cause.

Risk appetite: The type and level of risk an organisation is prepared to accept in pursuit of objectives.

Segregation of duties: Division of responsibilities so that one person cannot initiate, approve and conceal a transaction or action.

Review Questions

Short Answer Questions

1. Distinguish legal risk from compliance risk.
2. What information should be recorded in an obligation universe?
3. Explain the difference between preventive, detective and corrective controls.
4. Why is a KRI incomplete without a defined response?
5. State two limitations of relying solely on risk scores.

Long Answer Questions

1. Explain how a logistics organisation can design a compliance governance framework using the three-lines model.
2. Describe the stages of a legal audit and explain why both control design and operating effectiveness must be tested.
3. Discuss how contracts and third-party due diligence jointly manage logistics legal risk.
4. Evaluate the role of board oversight in preventing false assurance and unmanaged residual risk.
5. Explain how training, whistleblowing, investigation and remediation contribute to an ethical compliance culture.

Analytical / Application Questions

1. A freight forwarder discovers that a key subcontractor’s operating licence expired two weeks ago, while 40 shipments are in transit. Design an immediate response and a longer-term control improvement plan.
2. A company’s sanctions-screening system generates many false positives, leading staff to override alerts routinely. Analyse the legal and governance risks and propose a defensible redesign.
3. Using the NorthStar case, identify the decision rights, evidence and escalation steps required before approving a high-risk carrier exception.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes legal risk from compliance risk?

A. Legal risk concerns only criminal penalties, while compliance risk concerns only contracts.

B. Compliance risk is broader because it includes all business uncertainty.

C. Legal risk includes compliance failures as well as contractual, dispute and legal-rights issues.

D. There is no meaningful distinction between the two terms.

Correct Answer: C. Legal risk includes compliance failures as well as contractual, dispute and legal-rights issues.

Question 2

Which activity belongs primarily to the first line of the three-lines model?

A. Independent internal-audit assurance

B. Operational performance of controls by a transport manager

C. Board approval of risk appetite

D. Independent investigation by external counsel

Correct Answer: B. Operational performance of controls by a transport manager

Question 3

A risk has an estimated probability of 4% and a direct impact of $250,000. What is its expected direct loss under the stated simple model?

A. $1,000

B. $10,000

C. $25,000

D. $100,000

Correct Answer: B. $10,000

Question 4

Which is the strongest example of a preventive control?

A. A post-incident investigation

B. A monthly report of customs errors

C. A system block preventing dispatch when a required licence is missing

D. A review of historical litigation

Correct Answer: C. A system block preventing dispatch when a required licence is missing

Question 5

What is the principal weakness of a KRI that has no escalation protocol?

A. It cannot be displayed on a dashboard.

B. It measures only financial performance.

C. It provides information without defining the management response.

D. It automatically creates excessive legal liability.

Correct Answer: C. It provides information without defining the management response.

Question 6

Which fact is most clearly a third-party due-diligence red flag?

A. The supplier requests a standard delivery window.

B. The supplier refuses to disclose its beneficial ownership.

C. The supplier provides a current insurance certificate.

D. The supplier accepts an audit clause.

Correct Answer: B. The supplier refuses to disclose its beneficial ownership.

Question 7

Why should AI-generated contract classifications receive human review in material matters?

A. AI tools are legally prohibited in all contract work.

B. Automated outputs may contain errors, omissions or context failures.

C. Human review makes audit trails unnecessary.

D. AI can review only paper contracts.

Correct Answer: B. Automated outputs may contain errors, omissions or context failures.

Question 8

Which board report provides the most useful view of compliance exposure?

A. A list containing only completed training percentages

B. A dashboard showing only incidents that became public

C. A report distinguishing inherent risk, residual risk, accepted risk and out-of-tolerance risk

D. A report omitting uncertainty to avoid confusion

Correct Answer: C. A report distinguishing inherent risk, residual risk, accepted risk and out-of-tolerance risk

Question 9

In the illustrative NorthStar case, why was a sales waiver insufficient to approve the carrier?

A. Sales departments cannot communicate with carriers.

B. Commercial approval cannot override a legal prohibition or unresolved legal duty.

C. Waivers are never permitted in logistics.

D. The customer had no commercial interest in delivery speed.

Correct Answer: B. Commercial approval cannot override a legal prohibition or unresolved legal duty.

Question 10

Which feature most supports a credible whistleblowing system?

A. A promise of absolute secrecy in every circumstance

B. Reporting access, non-retaliation, impartial triage and documented investigation

C. Automatic dismissal of anonymous reports

D. Investigation only by the manager accused of wrongdoing

Correct Answer: B. Reporting access, non-retaliation, impartial triage and documented investigation