Question: while performing risk assessment what are the questions you should ask yourself?
Answer: How would you evaluate or describe the tone at the top of the organization?
How does the company communicate about the compliance program and/or compliance values?
Does the company take compliance seriously? Are there adequate resources?