Only the US and Switzerland actively enforce anti-corruption laws beyond their borders. Most organisations start with anti-corruption as the bedrock of their integrity risk framework – the exceptions tend to be the financial services sector (where money laundering and fraud are on the radar). Why?

I don’t know.

Maybe it’s because of sharks and mosquitoes. Sharks terrify a lot of people. But, if we’re rational:

🦈 Sharks kill approx. 10 people per annum.
🦈 These attacks occur in a handful of places.
🦈 Those places have increasingly effective controls.
🦈 Most of us can achieve 0% risk (spear-fishers, divers, etc. aside).

Mosquitos kill two-to-three million people a year. These risks span continents, and preventative controls remain patchy or weak (income, access, and resource-dependent).

What’s that got to do with integrity risks?

The likelihood of being caught up in a major corruption scandal is more shark territory. Very few significant corruption investigations have focused on small operational bribes (payments to get things you’re entitled to). Most fixate on large bungs (generally channelled through intermediaries) to secure big contracts. The regulators in most developed markets can sustain only a handful of investigations per annum. Shark risks – low(er) likelihood, easier to avoid than many others, and often localised to specific functions, sectors, and territories.

Mosquito risks differ – dengue, malaria, Zika, etc. They’re all the other integrity risks. For some, they might be supply chain sustainability, and for others, information security. Usually, it’s a blend, and fraud is typically overlooked (a summary of fraud risk 👇).

I’m not advocating tolerance or ignoring corruption – the bleeding day-to-day small bribes are the filthy glue holding together most human, wildlife, and environmental degradation. Just don’t start with BIG corruption (tenders, etc.) as the basis of your integrity framework because everyone else does.

Use a 3D assessment – external environment, internal ‘crown jewels’ vulnerability, and organisational culture – to right-size your risk profile.