If the company designs an ethics program without addressing change and control, the program will not adequately protect them from risk. Business supervisors and managers must rethink their old ethics programs by taking a much broader view of risk. In every situation, threats should be considered risks. If someone makes a strategic decision that puts the business at risk, then there is no accountability for why or how that decision was made. This involves environmental and organizational risks.
Environmental risks involve the laws and regulations of the company.
The organizational risk involves the acquisition and planning of the company. Operating risks happen when supervisors do the right things the wrong way. This occurs when someone does not follow procedures or when there is not a documented way of handling something. Financial risks have to do with how you manage the business from a financial perspective. Information risk refers to dealings with information and systems management on such issues as technology, regulatory reporting, taxation, accounting and budgets.