challenges. assessments of the appropriateness of a transaction for a client traditionally have required firms to determine if the transaction is consistent with the financial sophistication, financial condition, and investment policies of the customer. given recent events, it is appropriate to raise the bar on appropriateness assessments in the approval process for complex structured transactions by taking into account the business purpose and economic substance of the transaction. when firms provide advice on, arrange, or actively participate in a complex structured finance transaction, they may assume legal and reputational risks if the end - user enters into the transaction for improper purposes. firms should have effective and consistent policies and procedures that require a thorough review of the business purposes and economic substance of the transaction by all relevant functional areas and an assessment of any legal or reputational risks posed by the transaction. in instances that present heightened legal or reputational risk, the policies and procedures should require a review, by appropriate senior management, of the customer ’ s business relationship with the firm. of course, these policies and procedures need to be supported and enforced by a strong tone at the top and a firm - wide culture of compliance. conclusion the evolution of the financial markets and the number of significant governance issues recently faced by complex financial firms clearly underscore the need to view risk management on an enterprise - wide basis. an integral part of a robust legal and reputational risk - management function is a strong compliance program. for such programs to be effective in complex financial institutions, compliance must be addressed on an enterprise - wide basis.

. in addition, significant modifications to products, services, and activities or their pricing warrant review as a new product. even small changes in the terms of products or the scope of services or activities can greatly alter their risk profiles and justify review as a new product. when in doubt about whether a product, service, or activity warrants review as a new product, financial firms should err on the side of conservatism and route the proposal through the new - product approval process. cutting short a new - product review because of a rush to deliver a new product to market, or because of performance pressures, increases the potential for serious legal and reputational risk. the determination of whether a new or modified activity requires additional compliance processes, procedures, or controls is clearly the province of the compliance staff. it involves the interaction of business - line compliance staff with personnel responsible for enterprise - wide risk management. once these processes, procedures, or controls are designed, compliance personnel should help ensure that those controls are implemented effectively and are a comprehensive response to the legal and reputational risks posed. the role of internal audit just as the compliance area performs an independent review of the firm ’ s activities and business lines, the compliance program also needs to be reviewed independently. internal audit has the responsibility to review the enterprise - wide compliance program to determine if it is accomplishing the firm ’ s stated objectives, and if it is adequately and appropriately staffed, in light of growth, changes in the firm ’ s business mix, new customers, strategic initiatives, reorganizations, and process changes. internal audit should evaluate the firm ’ s adherence to its own compliance and control processes and assess the adequacy of those processes in light of the complexity and legal and reputational risk profile of the organization. it should be obvious that internal audit, like the compliance program, needs to be staffed with personnel who have the necessary skills and experience to report on compliance with financial institution policies and procedures. internal audit should test transactions to validate that business lines are complying with the firm ’ s standards and report the results of that testing to the board or audit committee, as appropriate. structured transactions there are “ lessons learned ” from the legal and reputational risks that some financial firms faced in structuring transactions for enron and worldcom, among others. those legal and reputational risks require a focus on appropriateness assessments, the enforceability of netting and collateral agreements, undocumented customer assurances, insurance considerations, and potential irs