Stage 2: Lead the enterprise · Module 13 of 15

Enterprise risk, compliance and crisis

Choose, own and watch risk across the whole company: run enterprise risk management, build a compliance program that works, and prepare for a crisis before it happens.

How this module works: read the lesson, try the scenario, reflect, then do the activity.

3 lessons · sign in to track progress

The lesson

Part 1

Enterprise risk management (ERM)

ERM looks at risk across the whole company — strategic, operational, financial, compliance, technology and reputation — and ties it to strategy, so management and the board agree which risks to take and which to avoid.

Set a risk appetite: the kinds and amounts of risk the company will accept to reach its goals.
Keep a risk register: each top risk with an owner, likelihood, impact, current controls and actions — reviewed by executives quarterly and by the board or a committee at least yearly.
The three lines: business leaders own and manage risk; risk and compliance teams advise and monitor; internal audit gives the board independent assurance.
Watch emerging risks: cybersecurity, AI, supply chains, dependence on key people or customers, and regulatory change.

Takeaway. Risk is not avoided; it is chosen, owned and watched.

Part 2

Compliance and ethics programs that work

Regulators and prosecutors look at whether a company's compliance program is effective — resourced, tested and used — not whether it has a binder of policies. The US Department of Justice publishes guidance on how it evaluates programs.

Core elements: a code of conduct, risk-based policies, training, a confidential hotline with no retaliation, investigations, consistent discipline and regular testing.
Areas that often matter: anti-bribery (including the FCPA for foreign dealings), antitrust, privacy and data protection, employment law, sanctions and export controls, and your industry's regulators.
Whistleblowers are protected by law in many situations, including under SOX and the SEC whistleblower program. Retaliation creates its own serious liability.
Give the compliance leader real resources and direct access to the board or audit committee.

Takeaway. An effective program is resourced, tested and used — not just written.

Part 3

Crisis management, cyber incidents and insurance

Every company will face a crisis. Preparation decides whether it becomes a disaster.

Keep a written crisis and incident response plan with a decision team, outside counsel, forensic and communications contacts — and rehearse it with a tabletop exercise at least yearly.
US public companies must report a material cybersecurity incident on Form 8-K within four business days of deciding it is material, and describe cyber risk management and governance in the annual report.
Review insurance at company level: directors and officers (D&O), cyber, crime and key liability policies — limits, exclusions and who is covered.
After any incident, run a no-blame review and fix the system.

Takeaway. Practise the crisis before it is real.

Which best describes you?

This only changes which examples and suggested modules you see — every lesson stays open to everyone. Your choice is kept on this device.

Illustrative scenario · Promoted inside an organization

Ransomware at 2 a.m.

The newly appointed president of a public company's largest division gets a call: systems at three plants are encrypted and production has stopped.

Think it through: Who needs to be involved in the first hour, and who decides whether the incident is material?

A composite example for learning — not a real case, client or result.

Reflect

What are your company's top five risks, who owns each one, and when did the board last discuss them?

Jot your answer somewhere private, or talk it through with Monet below.

Activity: Build a top-ten risk register

Ask each executive for their three biggest risks; combine and remove duplicates.
Rate each for likelihood and impact on a simple 1–5 scale.
Name one owner and the controls already in place for each.
Pick the three risks that need action this quarter and set review dates.

Use it on screen in the Operator Toolkit (members):

Enterprise risk register

Work through specifics with qualified professionals

Compliance obligations depend on your industry, locations and whether you are public. Confirm specifics with counsel, compliance professionals and your insurance adviser. This is general education, not legal, accounting, securities or investment advice.

Ask Monet about this module

Tap a question to open Monet with it ready to edit. Educational guidance only — not tax, legal or investment advice.

Educational guidance, not personal advice. Outputs are illustrative, may contain errors, and should be independently verified before material decisions.