The process should include an assessment of how those changes may affect the level and nature of risk exposures, and whether mitigating controls are effective in limiting exposures to targeted levels. To avoid having a program that operates on autopilot, an organization must continuously reassess its risks and controls and communicate with all employees who are part of the compliance process.
If compliance is seen as a one-off project, an organization faces the risk that its compliance program will not keep up with the changes in its services or customer mix. The board of directors needs to ensure the organization has a top-to-bottom compliance culture that is well communicated by senior management so that all staff members understand their compliance responsibilities.