Managers should be expected to evaluate the risks and controls within their scope of authority at least annually. An enterprise-wide compliance-risk management program should be dynamic and proactive. It should assess evolving risks when new business lines or activities are added, when existing activities and processes are altered, or when there are regulatory changes.
7.