Both as a matter of law and of common business sense, a Compliance & Ethics program should be based upon a Compliance & Ethics risk assessment. Among other things, a Compliance & Ethics risk assessment should address the likelihood and potential impact of foreseeable illegal or unethical acts. Ideally, it should do so not only on an enterprise–wide basis, but also on a more granular level (such as by geographic or business unit). The process should provide sufficient insight into the cause of such risks to assist the company in determining how best to use the resources of the program to mitigate risks. A risk assessment helps to shape not only the individual elements of the Compliance & Ethics program, but also how the program is managed by the top officials of the company and overseen by the board of directors. Kaplan & Walker LLP’s attorneys have conducted risk assessments for numerous companies, and the published works of its attorneys have helped shape the approach of others to this important and often challenging aspect of establishing or improving a Compliance & Ethics program.