2022 GLOBAL ESG,COMPLIANCE &RISK REPORT
Value creation amid rising global uncertainty

THE AUTHORS

DR. KATHARINA HEFTER

DR. BERNHARD GEHRA

DR. JULIA GEBHARDTHANJO SEIBERTREI TANAKALORENZO FANTINIMATTEO COPPOLANICOLA NICOLMANAGING DIRECTORMANAGING DIRECTORMANAGING DIRECTORMANAGING DIRECTORMANAGING DIRECTORMANAGING DIRECTORMANAGING DIRECTOR AND

MANAGING DIRECTOR

AND PARTNER

AND SENIOR PARTNER

AND PARTNER

AND PARTNER

AND PARTNER

AND PARTNERSENIOR PARTNER

AND PARTNERHEFTER.KATHARINA@BCG.COM

GEHRA.BERNHARD@BCG.COM

GEBHARDT.JULIA@BCG.COM

SEIBERT.HANJO@BCG.COM

TANAKA.REI@BCG.COM

FANTINI.LORENZO@BCG.COM

COPPOLA.MATTEO@BCG.COM

NICOL.NICOLA@BCG.COM

PIERRE ROUSSELJEANNE KWONG BICKFORD

JANNIK LEIENDECKER

TAD ROSELUNDPAUL O’ROURKEKEN CARLSTEDTJULIANE BUTTERSELISABETH BENAZIR LIPPERTMANAGING DIRECTORMANAGING DIRECTOR AND

PARTNER AND

MANAGING DIRECTOR AND

MANAGING DIRECTORASSOCIATE DIRECTOR,PROJECTSENIOR KNOWLEDGE

AND PARTNERSENIOR PARTNER

ASSOCIATE DIRECTORSENIOR PARTNER

AND PARTNER

GLOBAL TRADE & INVESTMENTLEADERANALYSTROUSSEL.PIERRE@BCG.COM

BICKFORD.JEANNE@BCG.COM

LEIENDECKER.JANNIK@BCG.COM

ROSELUND.TAD@BCG.COM

O’ROURKE.PAUL@BCG.COM

CARLSTEDT.KEN@BCG.COM

BUTTERS.JULIANE@BCG.COM

LIPPERT.ELISABETH@BCG.COM

0203

INTRODUCTION

Our analysis revealed the following seven core topics and conclusions:

The global regulatory environment has grown increasingly complex, and now spans a far broader range of issues than in the1.

past. Compliance functions have been heavily affected as a consequence. They must deal with multiple growing challenges,
such as sanctions and trade compliance and supply chain risks, as well as a general rise in regulation and regulatory
enforcement, especially in the environmental, social and governance (ESG) area. To compound matters further, the pace of

COMPLIANCE MANDATE
The clearer the mandate of the compliance function, the more it can create value for the company.

2.

change will only accelerate in a highly networked and digitized world.

GEOPOLITICS
If a company is equipped with crisis response plans, and with procedures for swift action in response
to volatile developments in supply chains and sanctions, the company will prove more resilient during

However, this new world should not only be seen as a challenge to overcome, but also as an opportunity to create value forthe company and forge ahead of rivals. As regulators raise the bar for all kinds of risks, the compliance function is set to playa pivotal role in managing these regulatory developments successfully and steering organizations through crises. For example,

times of geopolitical tension.

3.

ESG COMPLIANCE

the proliferation of sanctions over the past year has shone a new light on the crucial role of compliance departments in all

Taking concerted action to mitigate risk of ESG regulation enforcement only works if the gaps

industries. Similarly, headlines exposing greenwashing clearly demonstrate how important compliance departments are in

between ESG expectations and the reality are significantly narrowed.

guiding implementation of the relevant requirements.

4.

DIGITIZATIONIn these demanding conditions, companies need to define the terms of their compliance mandate for their relevant risks,

Adequate operating models enable companies to meet future challenges and seize

determine the role of their compliance function for these risks, and then optimize the function so that it lives up to thethe opportunity to reduce the cost of compliance.

mandate. To create value, the compliance function needs to fulfill different roles, according to the particular topic and specificrisk. Companies that succeed in this endeavor will gain sustainable competitive advantage, boost customer loyalty and trust,

5.

attract and retain talent, and enhance their reputation for acting responsibly in a testing business environment.

CYBERSECURITY
Insufficient investment in cybersecurity, resilience and testing, resulting in a failure to keep pacewith digitization or respond to escalating cyber threats, could have a significant impact on

But exactly how are companies reacting to the changing compliance landscape in order to gain an advantage and get closer
to their Target Operating Model (TOM)? Following our first RISK AND COMPLIANCE SURVEY FROM 2021, we repeatedthe exercise in May and June 2022, this time with the goal of identifying and then analyzing the core issues relating to riskbusiness performance and lead to an erosion of customer trust.

6.

BUSINESS ETHICS

and compliance. We interviewed 250 compliance professionals from companies across various industries around the world,

Consequent implementation of a defined ethical culture is the crucial step to establish

and asked them to name the foremost issues and challenges faced by compliance organizations, and how are they fulfillinga sustainable compliance awareness across the organization.

their compliance mandates. In asking these questions, we wanted to build a complete picture of the risk and compliancefunction, and how companies in general are coping with various types of risk and the myriad growing uncertainties in the
global landscape.

7.

WORKFORCE
A strong workforce strategy, involving carefully considered recruitment, training, and retention,is essential in unleashing the potential for compliance as a competitive advantage.

In a more complex world, simply writing policy guidelines and instructing employees to follow the rules will not be enoughto stay ahead of the game. Every company needs a strategy not just to manage current risks but also to adapt quickly as
circumstances, rules, regulations, and expectations develop. The goal of this study is to provide companies with the perspective
and tools they need to develop their compliance strategy, and then implement it successfully in the face of diverse andevolving compliance risks.

04

05

1 Compliance Mandate / 2 Geopolitics / 3 ESG Compliance / 4 Digitization / 5 Cybersecurity / 6 Business Ethics / 7 Workforce

SURVEY PARTICIPANTS

1.

FIGURE 1: OUR FINDINGS ARE BASED ON FEEDBACK FROM 250 COMPANIES …

COMPLIANCE MANDATE: Emphasizing value creation

Against a background of diverse and evolving compliance risks and rising uncertainties, setting out the compliance mandate
and the role of the compliance function for different types of risk is critical. The survey reveals that compliance organizations

REGIONS

are already dealing with a wide range of risk categories: fraud and financial crime risk, competition risk, information security/

32%

information technology risk, corporate and capital market risk, and employee risk. Interestingly, our analysis reveals that key

33%

ESG-related topics, such as sustainability, environmental law and human rights, are on average only included in the compliancemandates of around half to two thirds of organizations.

FIGURE 2: KEY RISKS UNDER COMPLIANCE MANDATE (IN %)
17%

94%

93%
89%

87%
79%

13%

75%

5%

74%
66%

INDUSTRIES

65%

64%

62%
56%

COMPANY SIZE (#FTE)DATAPROTECTION
LAW

CYBER
SECURITYREGULATIONSCORPORATEGOVERNANCE
RULES

MONEY LAUNDERING/TERRORISTFINANCING

BRIBERY/CORRUPTIONINTERNAL
THEFT ANDFRAUD

DIVERSITY &DISCRIMINATIONSTANDARDSSUSTAINABILITY

ANTITRUSTLAW

TRADE LAW
(IMPORT/EXPORT)

EXTERNAL
THEFT AND
FRAUD

54%

52%

OTHER
COMMERCIAL
CRIMINAL LAWENVIRONMENTAL
LAW

49%

HUMAN
RIGHTSEMBEZZLEMENT

This point highlights a crucial theme when it comes to the value creation ambitions of a compliance function - the importance ofcross-collaboration in ESG, risk and compliance management. The management of risk is not the sole preserve of the complianceand risk functions. Individual departments have in the past often used their own piecemeal risk management methods to keep
up with regulations. One frequent example is the procurement department. This siloed response fails to protect the business

PARTICIPANTSCOMPANY REVENUE

from financial penalties and negative public opinion. As many risks affect a variety of departments and processes within an
organization, effective collaboration is vital.

The key to creating true value from these cross-functional collaborations is a clear delineation of roles, setting out whichfunction has overall ownership of a particular area, and which is responsible for each part of the process. The role of thecompliance function can range from advisor to central oversight. One real-world example would involve compliance departments
collaborating closely with their colleagues in software and product development during agile development phases, making
sure that they are involved early in the process and achieving speed to output.
06

07

1 Compliance Mandate / 2 Geopolitics / 3 ESG Compliance / 4 Digitization / 5 Cybersecurity / 6 Business Ethics / 7 Workforce

2.

FIGURE 3: KEY TOPICS FOR COMPLIANCE ORGANIZATIONSGEOPOLITICS: Responding to global events

Much of the everyday work of compliance functions is currently taken up with responding to the requirements of economic

62%

CYBER SECURITY (incl. Data security)and trade sanctions during geopolitical tensions, and with the handling of global crises such as the pandemic.
52%

BUSINESS ETHICS

As the sanctions landscape becomes more complex and dynamic, sanctions compliance systems must become moresophisticated in response, and must interface seamlessly with broader trade compliance capabilities. Resolute consensus

DIGITIZATION & DATA ANALYTICS

42%

ESG (Environmental, social and governance)

42%

among governments is forcing companies to take a political stance, willingly or not. This has become particularly true witheconomic flows being increasingly used as a strategic weapon in foreign and security policy.

Companies need to be careful not to circumvent the growing number of financial and trade sanctions, including the recent

36%

SANCTIONS/ TRADE COMPLIANCE

wave of export controls related to high-end semiconductors. They need to develop a comprehensive organizational strategy
that allows them to monitor the details of an avalanche of newly introduced sanctions and respond accordingly in a timely

34%

DIVERSITY & RACIAL EQUITY

manner. The limited ambition simply to follow rules will not be sufficient in a world that is moving so quickly. This year’s
survey shows that sanctions and trade compliance have become even more important to compliance organizations, and now

30%

M&A (incl. due diligence of target’s business partners)

ranks among the top five key topics. This is a jump of 15 places from our previous survey in 2021.

26%

Global harmonization of standards/ regulation

Even without changes in regulatory or governmental requirements, any kind of upheaval can destabilize the environment inwhich the companies are operating. The global pandemic is such an example, and it shows how disruptions in supply chainscan pose a major threat to multinational companies. Decisions had to be taken in a shorter time span, while new business
partners had to be onboarded or new trade routes identified. Regular processes had to be expedited and different processes

New business models

23%

EU Directive on Corporate Sustainability Due Diligence,
German Supply Chain Due Diligence Act

22%

implemented. All these changes increased the risk of insufficient due diligence or of overlooking requirements.

20%

Need for efficiency gains

Reaction to these global crises in many companies has often been too slow. A company’s previous work to establish transparency
on these risks as well as its preventive measures were both crucial during these times and have certainly paid off. There isclearly a need for crisis response plans which facilitate swift decision making in relation to volatile developments in supply
chains and government sanctions, as numerous jurisdictions continue to implement and enforce local regulations.

Unsurprisingly, given developments in Europe over recent months, survey participants for the first time rank geopolitical tensions
as a key topic for compliance organizations (it is ranked at number 11). This correlates to the upward jump in sanctions andtrade compliance, as geopolitical tensions lead to expanded trade regulations and retaliations. A robust compliance operating
model ensures resilience against external shocks and uncertainties and strengthens crisis management. The major challengein crisis management is simultaneously handling a multitude of issues that demand a broad range of skills and capabilities.

GEOPOLITICAL TENSIONS

17%

Digital Markets Act (DMA)

16%

EU Whistleblower Protection Directive (2019/1937)

15%

EU Digital Services Act (DSA)

14%

EU AML Action Plan

14%

EU Taxonomy for sustainable activities ("Green taxonomy")

13%

Adverse media coverage (e.g. Influencer Marketing)

12%

10%

EU Artificial Intelligence Act (Draft)

08

09

1 Compliance Mandate / 2 Geopolitics / 3 ESG Compliance / 4 Digitization / 5 Cybersecurity / 6 Business Ethics / 7 Workforce

3.

ENVIRONMENTAL, SOCIAL AND GOVERNANCE (ESG): Meeting stakeholder expectations

Environmental, social and governance (ESG) issues have become a critical component of modern business practices.

The increasing importance of ESG is clearly reflected in our survey results, irrespective of the particular company’s region,

The reasons are clear – rising regulatory expectations, an increasing awareness of the threat of global warming, and moreindustry or size. A significant proportion (43%) of respondents selected ESG as one of the top five trends or topics that areconcern about the impact of company operations on the world around them.

most relevant for their compliance organization.

Since 2018, authorities worldwide have issued more than 170 new or amended ESG regulations. Guidelines such as

Moreover, a large majority (79%) reported that their commitment to ESG has intensified over the past two years. This is in

the EU Corporate Sustainability Reporting Directive (CSRD) are set to be further codified by clear standards currently

part because they see a notable increase in the amount of ESG regulation, and greater enforcement of these regulations forbeing developed by the European Financial Reporting Advisory Group (EFRAG) (see the recently published BCG paper

companies which engage in greenwashing or have not implemented the required changes to their products, services, reporting“ESG COMPLIANCE IN AN ERA OF TIGHTER REGULATIONS”).

mechanisms or organizational structure. Indeed, approximately 60% of respondents say that regulators are having the greatest
impact on their ESG efforts. After regulators in the ranking come customers (48%), and employees (47%). Respondents are

Companies must handle changing ESG regulations on topics such as climate change, human rights, and diversity. Given the

fully aware that increasing regulatory demands threaten a company’s survival. If its pursuit of ESG is less than comprehensive,

major gap between expectations and current reality, ESG compliance has placed companies under considerable pressure.

it will buckle under the weight of sanctions and a worsening reputation.

While cross-divisional collaboration can help to accelerate action and mitigate the risk of regulatory enforcement or losing
investors and clients, breaches of so-called social compliance lead to significant reputational risks.

FIGURE 4: MAIN DRIVERS FOR ESG EFFORTS
58%

DEEP DIVE: THE NEED FOR AN HOLISTIC APPROACH

60
47%

In February 2022, the EU Commission adopted a proposal for a directive on corporate sustainability due diligence.

48%

The aim of this directive is to foster sustainable and responsible corporate behavior, and to anchor human rights
and environmental considerations in companies’ operations and corporate governance.

40
26%
22%

The draft regulation requires large EU companies, and some non-European companies with significant business
operations in Europe, to assess their actual and potential human rights and environmental impact throughout

20

their operations and their supply chains, and to take action to prevent, mitigate, and remedy the harms to humanrights and the environment that have been identified.
0

Similarly, the soon-to-be-implemented German Supply Chain Due Diligence Act is designed to protect human rights
and the environment in supply chain operations. Companies need to respond with a holistic rather than a siloedapproach. Indeed, a governance triangle should be formed: the procurement function should examine vendors indetail; the human resources function should look at how employees are treated in the supply chain; and a humanThe survey reveals that the role of the compliance function differs from company to company. It can range from oversight overrights department can be introduced to consolidate the company’s overall approach and manage reporting (seeall ESG topics to responsibility for certain selected areas. The role of the compliance function for ESG in each company should

recently published BCG paper “MANAGING SUPPLY CHAIN RISK – AN UPDATE ON LEGAL AND STRATEGIC

be appropriate for the relevant business, operating model and ESG factors. However, given that ESG spans several existing

REQUIREMENTS”). Some jurisdictions, such as Australia, actually have a regulatory requirement to nominate

risk categories that typically fall within the compliance mandate, the compliance function usually plays an important role ina human rights officer. A holistic process is also necessary for ESG measurement, steering and reporting, where

ESG management. In particular, its experience of risk management systems should be sought when setting up governance,

similar methodologies should be used throughout the organization.

standards and reporting lines so that the compliance function can create the greatest possible value in a given area.

1011

1 Compliance Mandate / 2 Geopolitics / 3 ESG Compliance / 4 Digitization / 5 Cybersecurity / 6 Business Ethics / 7 Workforce

4.

FIGURE 5: DIGITIZATION READINESSDIGITIZATION: Making up for lost time

Dealing with burgeoning regulation can easily lead to spiraling costs. So how then do companies and their compliance60

functions manage to inject efficiency into this process while still operating in the most effective way possible?

Digitization is the most common answer to this question. However, it is important to have a clear definition of what this40

entails. Companies need to understand what their problems are, what needs to be done and how digitization can help to reachthese objectives. Upgrading the front end while the back-end processes are still manual and inefficient does not add up togenuine digitization. Cross-divisional collaboration for rethinking the end-to end client journeys is necessary, focusing at all

20

times on what benefits the client experience. In that regard, digitization can certainly contribute greatly to raising efficiency,
for example by streamlining labor-intensive processes such as Know Your Customer (KYC), transaction monitoring, screening
and risk assessments, making controls more automated and data-driven, and reporting. Automated document capture and0read-out of relevant data such as “use of goods” can reduce the cost of compliance and error rates (see, for example, theBCG LinkedIn article “FUTURE PROOFING COMPLIANCE WITH TECHNOLOGY & DIGITAL”).

Despite digitization’s potential, many companies are not properly preparing their operating model to meet future challenges,
and are missing the opportunity to reduce the cost of compliance. Indeed, a TOM and an integrated architecture (processes,
data, applications, and tools) are often lacking, despite the fact that digitization requires an overarching strategy and clear
objectives. For example, universal banks have often invested in tools which come from various sources and are disconnected

At the other end of the scale, 24% of respondents admitted they are dealing with the development of digital compliancefrom each other. As a result, businesses often lack support when it comes to data, artificial intelligence, anti-financial crime

strategy either poorly or very poorly. Indeed, respondents at every level of compliance maturity said they are still working on

and fraud efforts, and getting ahead in the war for talent.

the development of a fully digitized compliance function.

Respondents to our survey certainly see the importance of digitization. They cited digitization and data analytics as one of the

FIGURE 6: DIGITIZATION READINESS

top five trends in compliance, and one third of respondents pointed to it as a key challenge for their compliance organization.
Moreover, the integration of business and digital goals is seen as a major challenge among the participants. More than half(54%) claim they are well or very well positioned to adapt to the digitization trend.
40

35%
31%

However, more detailed questions on digitization maturity show there is much work still to be done. Although the majority
say they are well or very well positioned to adapt to the digitization trend, more than half of respondents (52%) state thatthey have not advanced very far along this road. They are only just starting to air ideas and introduce pilots for one-off digital

18%

20

initiatives within selected parts of their compliance organization, but are not fully aware of the digital use cases that exist.

10%6%Companies with a more advanced Compliance TOM appear to have started the digitization journey earlier. They are more0aware of the role digital can play, and understand data strategy. Those who say they have made considerable progress attribute
their success to making digital compliance their top priority and an integral part of the CEO agenda. This finding reaffirms
the hypotheses reached in the BCG ESG, COMPLIANCE AND RISK REPORT 2021.

12

13

1 Compliance Mandate / 2 Geopolitics / 3 ESG Compliance / 4 Digitization / 5 Cybersecurity / 6 Business Ethics / 7 Workforce

5.

CYBERSECURITY: Addressing critical gaps

Increasing impacts from cyber and privacy attacks continue to escalate in prominence and frequency. As companies
operate in an increasingly digitized way, the more they will need to assess and enhance their cyber-resilience.
The effective application of technology in compliance requires excellent planning and careful orchestration of many different
elements. Companies need to be able to analyze the vendor landscape, and ensure that the selected compliance technology

When asked which topic was most relevant for their compliance organizations, the clear winner was cybersecurity. Indeed,fits neatly with operational needs. This in turn requires deep knowledge of data protection regulation in different jurisdictions,the topic was cited by 62% of respondents, 10 percentage points more than business ethics, the next most cited topic. Thisand an innovative, digitally oriented mindset. As with cybersecurity, the compliance workforce must comprise a diverse range

comes as no surprise, given the considerable risks—to the business, customers, and reputation—in neglecting cybersecurity.

of subject matter experts if it is to implement a successful digital compliance strategy. There is a growing demand for cyber

Cyber threat actors are becoming more aggressive, more sophisticated, more persistent and more successful. Companies

risk professionals, who can bring risk domain expertise to address the increasing risks of cyberattacks and compromise.

have therefore been strengthening their commitment to cybersecurity, especially amid heightened geopolitical tensions.

Indeed, the slow pace of digitization within the compliance function can be mainly put down to a lack of sufficient know-how

Many companies do not yet have adequate cybersecurity capabilities, management and governance processes, with insufficientand tools. Many companies are keen to tackle the know-how gap by developing a comprehensive people strategy to attract talent

investment in security, resilience and testing. They currently lack the right monitoring, controls and warning indicators towith the required expertise to exploit the potential of digital across the compliance unit. A good example of such upskillingboth prevent, respond to and recover from cyber threats. Lack of security investment, resulting in a failure to keep pace withefforts would involve building up a hub team, staffed with data scientists and engineers, as well as a spoke team, comprising

digital investment, can exact a high price at an unknown later date. Regulation is tightening in this sphere too, for example

data scientists and engineers who only work with compliance-related projects and hence build subject matter expertise.

with the Cyber Incident Reporting for Critical Infrastructure Act, signed into law in the United States in 2022. The law sought
to ensure that critical private sector entities report cyber incidents and ransomware payments to the US government.

As companies deploy transformative Artificial Intelligence (AI) tools, they must ensure that they introduce these solutions
in a responsible way, mitigating any potential risks to their business and protecting consumers. With the imminent arrival

It is therefore encouraging that 73% of respondents say they are already well or very well positioned to improve performanceof the European Union’s AI Act, one of the first broad-ranging regulatory frameworks on AI, the failure to implementin this regard, thanks largely to the fact that their compliance mandates include cybersecurity regulations and data

Responsible AI successfully will lead to serious implications (see BCG paper “RESPONSIBLE AI FOR AN ERA OF TIGHTER

protection laws.

REGULATIONS”). To have people who are carefully and diligently working on and learning from these technologies isof critical importance for organizations and for the people who will suffer the consequences of AI systems that are not

FIGURE 7: CYBERSECURITY READINESS

equipped with ethical guardrails.

60

43%
40
30%
23%
20

1%

3%

0

14

15

1 Compliance Mandate / 2 Geopolitics / 3 ESG Compliance / 4 Digitization / 5 Cybersecurity / 6 Business Ethics / 7 Workforce

Strong cybersecurity also requires good IT infrastructure management. However, more than a third (38%) of respondents

6.

BUSINESS ETHICS: Establishing a culture of integrity

say that adequate IT infrastructure remains one of their three biggest challenges, and 27% say they are not well equipped
to deal with it.
A culture of integrity, where employees actually practice what the company preaches on ethical business behavior, nurtures
To overcome these challenges and rapidly improve cybersecurity, a committed senior management must implement a top-down

prudent decision making in difficult situations and elevates compliance departments to the position of influential and sought-

strategy with a persistent emphasis on identifying and protecting their highest risk assets, while the compliance departments

after advisor.

should always be closely involved to ensure that key regulatory developments are managed and governed effectively.
The importance of this topic was clearly reflected in our survey. More than half of all respondents - regardless of industry andCompanies will need to introduce a range of cross-functional initiatives, designed to encourage collaboration, and spreadregion or maturity stage - included business ethics among the top five topics most relevant to their compliance organizations.

diverse subject matter expertise among business units and corporate functions. Such collaboration is critical, with the goal of

All respondents said that business ethics is a key component of proper governance.

establishing resilient cybersecurity processes comprising various elements, such as IT, operational risk, business continuity,
Given the significance attached to this area, companies are keen to promote ethical behavior in their business practices. A

anti-fraud and data protection.

high percentage (79%) rank themselves as either well or very well positioned in this regard, while just 4% say they are poorly
A critical element of cybersecurity is effective staff education and awareness of the required cyber practices. Stolen credentials

or very poorly prepared. Respondents generally agree that their written codes of conduct are now well established, and haveare responsible for more than half of ransomware attacks, not least because passwords such as “123456” or “qwerty” arebeen clearly communicated to all employees (70%). Moreover, a majority report that their compliance mandates include

still very commonly used. Enforcing password requirements, multi-factor authentication and applying security patches are

specific risks related to business ethics.

important contributory factors to the effective prevention of attacks. Threats and risks will still flourish if companies continue
to overlook the human element of cybersecurity, no matter how substantial the investment in security tools and network
defense. The first, and in this context the last, line of defense against cyberattacks needs to be enabled in order to ensure secure
operations. Organizations should provide employees with time, education, and resources to learn more about cybersecurity,

FIGURE 8: TREND ADAPTION BUSINESS ETHICS

and take a human-centric approach to designing training, cyber practices and incident responses in the event of attacks.

Above all, companies need to know what cyber-risk profile they are aiming to achieve, and where the most important

60

gaps remain. Scenario-driven exercises that simulate cyberattacks assist teams to build and develop the critical

48%

skills and experience needed for effective incident response. A comprehensive cybersecurity strategy is necessary. It should
be supported by management and receive the required level of investment to maintain the organization’s cyber-risk profile

40

within its risk appetite.

31%

An innovative approach would be to bring customers and other stakeholders on board in striving to boost cybersecurity. A

18%

20

trend exists at the moment to offer hackers a bonus (bug bounties) if they manage to enter the relevant company’s systemand then log and report their activity. Moreover, there is an increasing focus on collaboration and information sharing between
organizations, industry sectors, governments and consumers. Cyber is a collective problem, requiring a collective response.

1%

3%

0

However, our survey suggests that many companies still struggle to create effective whistleblowing systems that promote a
culture of speaking out in response to non-compliant behavior.

16

17

1 Compliance Mandate / 2 Geopolitics / 3 ESG Compliance / 4 Digitization / 5 Cybersecurity / 6 Business Ethics / 7 Workforce

7.

WORKFORCE: Securing the right skills

DEEP-DIVE: WHISTLEBLOWING
Recent regulatory action has made whistleblowing a clear priority for all compliance departments. In 2019, forexample, the European Union (EU) passed their Whistleblower Directive, aimed at protecting whistleblowers. By 2023,

Because ESG, risk and compliance have become more complex, and the demands of agile, customizable collaboration models

companies with more than 250 employees in scope of the German Supply Chain Due Diligence Act must implement

have grown, the compliance team needs to incorporate a more diverse skillset, involving a range of technical know-how, subject

a system in which employees and external third parties can report potential misbehavior. In 2019, the EU passed thematter experts and take on various roles. This increase in demands for compliance workforce coincides with a tense labor

EU Whistleblower Directive, aimed at the protection of whistleblowers. From December 2021, companies with moremarket where finding candidates is a challenge already. Qualified employees have more demands and expectations towards

than 250 employees have needed to implement a system where employees and third parties can report potential

ethics and ESG. More than anything else, it is now the quality of the workforce that determines the success of a company’s

misbehavior These organizations therefore need to put in place a complaints mechanism where all people, regardlesscompliance management. A strong workforce strategy – involving recruiting new people and upskilling current employees -of their connection to the company, can report incidents relating to violation of human rights and certain environmental

is therefore essential in unlocking the potential for compliance as a competitive advantage. A human resources department

protection laws. Whistleblowers can choose to report their concerns either internally or to external authorities. In

that effectively manages this strategy and mitigates risks will raise a company’s standing in the market.

specific circumstances, they can even report their concerns publicly, through social media for example, leading to
reputational damage. The identity of whistleblowers and any third parties mentioned must always remain confidential.

Attracting new talent, devising hiring strategy, ensuring the availability and capacity of training, and retaining employees in
the midst of the Era of Great Resignation, are all issues faced by companies across all industries in our survey. When asked
about the challenges they foresaw for their compliance organization, almost 70% of respondents pointed to “attracting talent,”

Given its importance in the effectiveness of whistleblowing, it is perhaps not surprising that a significant number of participantsa far higher proportion than for any other option.

(30%) state that culture is one of their top five overall compliance challenges. A sustainable ethical culture with robust
compliance and a strong sense of integrity leads to three major commercial benefits: it creates economic advantage for

Moreover, the survey reveals that all companies regardless of industry have yet to find the ideal strategy in response, saying thatcompanies, prevents substantial fines and reputational damage, and helps to attract and retain key talent.

they are merely adequately, or even poorly, positioned for this challenge. Moreover, attracting talent is unlikely to get any easier,given that 68% of respondents say the required range of qualifications for roles in their compliance organizations - comprising

But what are the necessary elements that combine to create such a sustainable compliance culture? One important successskillsets, expertise, and technical qualifications - is only likely to expand, and a further 18% say it will expand significantly.

factor, widely accepted in the compliance community, is clear leadership behavior. The success of an ethical culture greatly
depends on executives setting the tone from the top, acting as role models in living up to cultural standards. One quarter

The growing importance of cybersecurity and the digitization of compliance activities are a major concern among respondentsof our respondents say that establishing a “sense of urgency from senior management” is among the top five challenges

when considering the future of the workforce. Subject matter expertise, cross-functional collaboration, and an awareness of thefor their compliance organization. Every employee should be fully aware that compliant behavior is vitally important for the

ever-growing inventiveness of hackers and cybercriminals will be essential. The workforce of the future will need to stay up towhole organization and that senior management will be held accountable for any misconduct.

date technologically and adapt quickly to changing risks and regulations.

Companies can find it difficult to establish a compliance culture that incentivizes employees to live a culture of integrity andAs was reflected in respondents’ concerns, the requirements for the future workforce extend well beyond technical know-how.

indulge in the right behaviors. Making guidelines simpler for employees would certainly help. An unwieldy number of rules

As the risk and compliance environment grows increasingly complex, the emphasis on strong business ethics will only increase,that are difficult to put into practice hinders effective and successful compliance. Making the processes user-friendly, on theencouraging employees to make their own ethical assessments of what is right and wrong. Simply ticking boxes indicatingother hand, will boost compliance with standards and foster an ethical culture. The target culture should be articulated clearly,

compliance with various regulations will no longer suffice.

providing enough use cases to demonstrate the connection between concept and business practice, so that employees all
immediately recognize what correct behavior looks like and can report things they believe are not right.

The growing emphasis on ESG and other topics obliges the compliance workforce to keep abreast of developments, see thebigger picture, apply their expertise to new areas and think along more global lines, while keeping pace with the required new

Certain factors that are vital in building the right culture - the tone from the top, accountability, incentives and communication -collaboration model to manage risk cross-departments. As the social component of ESG grows in importance, companies will

can be measured and controlled. Indeed, data and technology can be put to good use here. Digitization can certainly also makeneed to be sensitive to the human rights risks that flow from working with multiple suppliers and global sources.

it more straightforward for employees to be compliant due to the greater ease of communicating and following due process.
See also the BCG publication PERSPECTIVES ON MONITORSHIPS AND SUCCESSFUL COMPLIANCE TRANSFORMATION– A BCG COMPLIANCE MAGAZINE SPECIAL ISSUE.

18

19

FIGURE 9: CORE CHALLENGES FOR COMPLIANCE ORGANIZATIONS IN THE FUTURE

Political issues are encroaching more than ever on the global economy. Compliance professionals must therefore be able toidentify and analyze complex scenarios, and consider both political and economic factors. This will help to ensure that theircompany’s compliance strategies, and how they are implemented, are flexible enough not just to react to events but to anticipate

68%

ATTRACTING TALENT43%

ORGANIZATIONAL COMPLEXITY (e.g. between business units)

Sufficient IT-infrastructure38%

Overall rising costs for compliance37%

Rising regulatory scrutiny

36%

Sufficient workforce capacity for implementation

33%

Development of a digital compliance strategy

32%

Supportive overall culture

32%

Sufficient budget for implementation

32%

30%

Cost cutting

Leveraging internal knowledge

28%

Integrating business goals and digitization goals

26%"Sense of urgency" from senior management

25%

Improving efficiency of first line of defense

25%

15%

Leveraging external knowledge

them and prepare accordingly.

The attitudes of employees are also changing, and companies must adapt accordingly to attract them and keep them on board.
Members of Generation Z in particular—those born between 1995 and 2010—say they want their work to add value to society,and care more about ESG when choosing their employer. Moreover, new employees expect companies to allow for remote
working and offer state-of-the-art digital technologies and work processes.

As the talent war intensifies, companies therefore need to manage their ESG-related reputations with care, and think differently
about their working practices and their impact on risk and compliance. In some sectors in particular, companies are heavily
burdened by the effort required to prevent ESG violations and implement social compliance throughout their supply chains,and by the constant threat of regulatory retaliation and reputational damage.

This is particularly true for industrial goods and healthcare companies. The implementation of due diligence in 3TG (tin,tungsten, tantalum and gold) supply chains enables responsible sourcing of 3TG from countries like Nigeria. New regulations andcampaigns against bribery and corruption in many countries have raised the bar for supply chain compliance risk management
in all industries. The general population sets higher standards for public or private sector entities in healthcare in particular.
Many of these organizations need to make significant enhancements to the current relevant supply chain and business partnerdue diligence processes, e.g. by raising the level of automation. In this way, they can avoid regulatory scrutiny, negative headlines
and loss of face with their own workforce.

Simply advertising for a position will not achieve the requisite results. Companies need to be more imaginative in their talentstrategies, more aware of diversity and inclusion, and ready to respond to the demand for a more flexible workplace. They alsoneed to be careful that the rapid expansion of compliance organizations - 57% expect them to increase in size – does not damage
efforts to establish the right culture, given the difficulty of transmitting company values to many new joiners at the same time.

Recruiting new people alone will not be sufficient in building the right workforce. As technology advances and workplace strategies
evolve, existing employees will need to be trained in relevant new knowledge and skills. Training capacity, including substantial
ramping up of relevant IT capabilities, should therefore be greatly expanded.

Indeed, companies need to develop a clear and comprehensive workforce strategy that does not leave the company vulnerable
to skills deficiencies at any given time. Our survey makes clear that compliance organizations should be equipped with adiverse skillset that can deal with all relevant types and areas of risk, and can fulfill the various roles required within flexible
collaboration models. In a more competitive world, companies should pinpoint exactly what skills they most need, where they
can be found and how they can be developed. It is not feasible to fight for talent on all fronts, and companies must therefore
focus on their priority areas.

20

21CONCLUSIONABOUT BCG

Companies need to take action in various areas in order maximize the value creation of their compliance

Boston Consulting Group (BCG) partners withorganizations. They need to define the precise mandate of the compliance function for each type of risk, define anleaders in business and society to tackle theiradequate approach of its role to address the different demands, and clearly allocate other relevant responsibilities

most important challenges and capture theiracross different departments. Plans for swifter and nimbler crisis response can minimize the impact of major

greatest opportunities.

geopolitical events that have bedeviled businesses in recent years. On environmental, social and governance issues,
they have to bridge the gap between their communicated ambition and the often much more modest reality.

BCG was the pioneer in business strategy when
it was founded in 1963. Today, we work closely

Many companies have fallen dangerously behind in the digitization journey. As they hurry to rectify this situation,with clients to embrace a transformational

they need to maintain their focus on what the clients want and what their business needs. On cybersecurity too,

approach aimed at benefiting all stakeholders—

they often have much ground to make up, and senior management should urgently implement a comprehensive

empowering organizations to grow, build

value-for-money strategy and a range of cross-functional initiatives. To foster ethical behavior, companies must takesustainable competitive advantage, and drive

the necessary steps to change the culture, and make it simpler for employees to voice any concerns. Regulators,

positive societal impact. Our diverse, global

investors, customers and employees are probing this gap with increasing energy and concern.

teams are passionate about unlocking potential
and making change happen, delivering integrated

But of all the factors that make for a successful compliance organization, the right workforce is essential.

solutions through leading-edge management

No such organization can prosper, therefore, without a prudent workforce strategy that considers how best to

consulting, technology and design, and corporate

attract, retain, motivate, and train their people. Given the clear need for a more diverse skillset addressing theand digital ventures.

functional demand as well as the role flexibility, the definition of an appropriate people strategy is key.
Whether you want to advance an idea, acapability, or the world at large, BCG is with you
every step of the way. We excel in the businessof human potential, and believe in its power to

FOR FURTHER CONTACT

shape strategic, organizational, economic, andIf you would like to discuss this report,societal change.

please contact one of the authors.

For information or permission to reprint, please contact BCG at permissions@bcg.com.
See bcg.com for BCG’s latest content. There, you can also register to receive e‑alerts about this or other topics.
Follow Boston Consulting Group on Facebook and Twitter.
© Boston Consulting Group 2021. All rights reserved.
11/2022—

www.bcg.com