How is the principle of "proportionality" applied when designing and implementing an organizational compliance program?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Check this out: if you're running a small, family-owned local bakery, you don't need a compliance program with a global hotlines office, a dedicated sanctions team, and 50 compliance policies in ten languages. But if you're a multinational bank with offices in 40 countries, you absolutely do! That's the principle of proportionality. Your compliance effort has to match your actual footprint and risk level. The correct answer is B. Regulators don't want a cookie-cutter program; they want one tailored to your specific size and risks. Options A, C, and D try to lock compliance into rigid mathematical ratios based on profit, headcount, or revenue—and in the real world, that's just not how effective risk management works.
Full explanation below image
Full Explanation
The correct answer is B. The principle of proportionality is a cornerstone of international compliance standards, including guidance from the UK Ministry of Justice, the OECD, and the US Department of Justice (DOJ). It dictates that a compliance program should be scaled to fit the company's specific risk exposure. A small business with domestic operations faces different risks than a multinational enterprise dealing in high-risk sectors (such as oil and gas, defense, or financial services). Consequently, the complexity, resources, and oversight of the program must match the scale and risk profile of the business.
Let's analyze why the other options are incorrect: - Option A is incorrect because tieing the compliance budget rigidly to net quarterly profits is dangerous. During economic downturns or periods of low profit, compliance risks do not decrease—and may actually increase—so reducing funding could expose the company to severe regulatory failures. - Option C is incorrect because setting a strict, fixed ratio of compliance officers to total employees ignores operational differences. A tech startup with 500 remote developers needs a different compliance structure than a manufacturing company with 500 workers on a factory floor dealing with environmental and safety regulations. - Option D is incorrect because compliance programs are designed to prevent and detect wrongdoing proactively, rather than merely managing or capping legal defense and litigation costs as a ratio of revenue.
A proportionate program ensures that resources are allocated efficiently to areas of highest risk, rather than wasting capital on unnecessary administrative overhead.