Conclusion Controlling compliance risk may be easier said than done. Certainly, establishment of an effective enterprise-wide compliance-risk management function and program is not done overnight. Nor is it done without costs--both monetary costs and the intangible costs inherent in real cultural change.
However, it is clear that all organizations must find ways to effectively manage compliance risk--and there is growing consensus within the industry that for some of the largest and most complex organizations, an enterprise-wide approach to controlling compliance risk is no longer just a "nice thing to have." Rather, it has become an essential element of effective risk management. 4  BIS Review 42/2006