Ethics, Compliance Auditing, and Emerging Issues

Ethics, Compliance Auditing, and Emerging Issues is the capstone deliverable of OMM 640 — worth 30% of the final course grade, the single heaviest assessment in the course, tagged to all three Weekly Learning Outcomes, all six Course Learning Outcomes, and the full NACE competency set [WLOs: 1, 2, 3] [CLOs: 1, 2, 3, 4, 5, 6] [NACE: 1, 2, 3, 5, 6, 7, 8]. The assignment asks you to step into the role of a consultant hired by a new CEO to build a proposal addressing an emerging global risk — establishing an ethics program, a training plan, and a compliance-auditing plan in response to that risk. This guide restates the requirements as an exact checklist, breaks the deliverable specification down line by line, gives a research strategy for your five required sources, walks each requirement directive-by-directive with the exact verbs Canvas uses, maps requirements to the grading rubric, offers a suggested outline, lists common pitfalls, and closes with a week-by-week prep timeline and a Quick Reference table.

The Prompt, Restated

Prior to beginning work on this assignment, review Chapter 10 of the textbook and Figure 10.4, the World Economic Forum's 2024 Global Risk Report, and select one of the risk areas it names: economic, environmental, geopolitical, social, or technological. For this assignment, imagine your task is to create a proposal for the new CEO of your organization, discussing how the organization can address an emerging global risk. You have been asked to build a proposal that establishes an ethics program, a training plan, and a plan to conduct compliance auditing.

Canvas lists the formatting requirements as an explicit checklist. Meeting every item is a floor for a passing grade, independent of the quality of the analysis — a well-argued paper that misses a formatting requirement still loses points on that requirement.

Every other element of this paper — the countries you name, the stakeholder analysis, the training plan, the compliance audit — flows from the single risk area you select at the outset. Figure 10.4 in Chapter 10 reproduces the World Economic Forum's 2024 Global Risks Report ranking of risks by severity, color-coded by category: economic (dark blue), environmental (light blue), geopolitical (yellow), societal (red), and technological (gray), ranked by expected impact within 2–3 years and within 10 years. The report finds that misinformation driven by AI is the leading near-term concern, while environmental risks such as extreme weather carry high impact in both the short and long term, and technological risks are expected to grow substantially over the 10-year horizon.

Chapter 10 also names four broader trends the World Economic Forum identifies as shaping these risk categories: climate change and its trajectory, demographic bifurcation (changes in population size, growth, and structure worldwide), technological acceleration (the developmental pathways of frontier technologies), and geostrategic shifts (the material evolution in concentration and sources of geopolitical power). These four trends are a useful secondary lens once you have picked a primary risk category — they help explain why your chosen risk is emerging now rather than being a static, long-standing concern.

The verb is describe, and the grading expectation is a specific, well-sourced account of one concrete emerging risk within your chosen category — not a generic restatement of the category itself. "Cybersecurity is a growing concern" is a category label; "the rise of generative-AI-assisted phishing, which IBM (2024) found mentioned in over 800,000 posts on illicit dark web markets in 2023, represents an emerging technological risk because it lowers the skill barrier for convincing, multilingual phishing campaigns" is a described risk.

Use Chapter 10's own scale/sensors/sensibilities framework (C. Meyer and Kirby, 2010, as cited in Gonzalez-Padron, 2025) to structure the description: explain the scale of the risk's potential impact (how many organizations, employees, or customers could be affected), what sensors or evidence sources have detected or measured it (breach reports, WEF risk rankings, industry surveys), and what sensibilities or stakeholder expectations have shifted around it (growing public concern, employee anxiety, investor scrutiny).

The verb is identify, and the requirement is explicitly plural — "all countries," not one representative example. This directive rewards genuine breadth: if your risk is geopolitical trade disruption, you might identify the countries directly involved in a sanctions regime (Russia, and the nations enforcing or circumventing sanctions such as those routing trade through Dubai or Hong Kong, per Cheong and Sharma, 2024, as discussed in Chapter 10), plus countries indirectly affected through supply-chain dependency. If your risk is environmental, you might identify countries with high exposure to extreme weather events plus countries whose supply chains depend on commodities produced in those regions.

The UAGC Library's Country Profiles resource and Database Search Tips, both linked directly from the assignment page, are the recommended starting points for finding country-specific information efficiently rather than relying on general web search.

The verb is describe again, but the object shifts from the risk itself to its differentiated effects country by country. This is where relativism-adjacent reasoning from the discussion forum becomes directly useful: the same global risk rarely produces identical effects everywhere, because local regulation, enforcement capacity, labor markets, and cultural context differ. A strong paper does not describe the risk once and then simply repeat the same paragraph with a different country name substituted in — it identifies what is actually different about how the risk plays out in each named country.

• Regulatory environment — does the country have strong enforcement of relevant laws (data protection, labor standards, environmental regulation), or does the same underlying risk carry substantially more exposure there because enforcement is weak?
• Economic dependency — is the country's economy or your organization's local operation particularly exposed because of a concentrated industry, a key supplier relationship, or currency/trade sensitivity?
• Social and cultural context — does the risk interact with local labor-market conditions, workforce skill availability, or public sentiment in a way that differs meaningfully from your home market?
• Political stability — does geopolitical instability in the country amplify the risk (as Chapter 10 describes with organized-crime-linked suppliers and sanctions evasion in regions of lower deterrence)?

The verb shifts to evaluate — a judgment-forming verb, not a descriptive one. This directive asks you to assess how well (or poorly) ethical decision-making processes function when an organization confronts your specific global risk, not simply to define what ethical decision-making is in the abstract. Draw on Chapter 10's benign/disputed/problematic moral-pressure framework (Bowie & Dunfee, 2002) to evaluate which category your risk's associated pressures fall into, and what that implies for how decisively the organization should act.

For example, if your risk is generative AI's workforce displacement effects, an evaluation might argue that the ethical pressure here is genuinely disputed rather than benign or problematic — reasonable stakeholders disagree about how aggressively to automate versus retrain — which means Bowie and Dunfee's recommended response (act consistently with the firm's own core values) is the appropriate decision-making stance, rather than either blanket compliance or blanket resistance.

The verb is analyze — breaking the impact down into its component stakeholder groups rather than treating "stakeholders" as one undifferentiated audience. At minimum, address employees, customers, suppliers, investors, and the communities in which the organization operates, and for each, explain the specific mechanism by which your chosen risk and the organization's ethical response to it changes that relationship.

• Employees — does the risk (and the organization's handling of it) affect trust, morale, retention, or perceived fairness? Chapter 10's workplace-transitions material on AI-driven job displacement fears is directly relevant if your risk touches technology or automation.
• Customers — does the risk affect product safety, data privacy, or service reliability in ways that shape customer trust and brand reputation?
• Suppliers — if your risk involves global trade, sanctions, or labor conditions, how does the organization's ethical stance toward suppliers change the durability of those relationships?
• Investors — does the risk carry financial, legal, or reputational exposure material enough to affect investor confidence or ESG-related scrutiny (Chapter 10's discussion of CCOs' role in ESG strategy is useful here)?
• Communities — does the risk have local community effects (environmental, economic, safety) that shape the organization's social license to operate in the countries you identified in Directive 2?

This directive is the hinge between the risk-analysis half of the paper (Directives 1–5) and the program-design half (Directives 7–9): before you build the training and auditing plans, you must analyze why they are necessary in the first place, specifically in response to your chosen risk. Chapter 10's closing section on the future of the ethics and compliance function supplies the strongest material here — the chapter notes that 72% of companies expect to increase staffing for ethics and compliance functions (KPMG, 2024), and that ethics and compliance professionals build organizational legitimacy, "a generalized perception or assumption that the actions of an entity are desirable, proper, or appropriate within some socially constructed system of norms, values, beliefs, and definitions" (Suchman, 1995, as cited in Gonzalez-Padron, 2025, p. 574).

Build the necessity argument on three legs: an ethics program is necessary because emerging risks like the one you selected create new, previously unaddressed ethical exposure that existing policy likely does not cover; training is necessary because employees cannot be expected to navigate a new risk ethically without explicit guidance — echoed directly in the Week 6 video's closing point that safe, ethical AI integration requires clear guidelines and regulation, not employee good intentions alone; and compliance auditing is necessary because, as Chapter 10 emphasizes throughout its discussion of data-driven compliance, organizations cannot manage what they do not measure, and auditing is the mechanism that verifies whether the training and policy are actually changing behavior.

The verb is design, and Canvas explicitly enumerates four sub-elements the training plan must include: the goals of the training program, the objectives of the training program, the learning methods or activities of the training program, and how the training program will be evaluated. Missing any one of the four leaves a named checklist item incomplete, so address each as its own clearly labeled element rather than folding them together into one paragraph.

The assignment separately asks you to describe how the training will be conducted (delivery logistics — audience, frequency, format, who leads it) beyond just the four goals/objectives/methods/evaluation elements. Treat this as a short operational note following the four-part design: who gets trained, how often, and by whom.

This directive asks specifically how compliance auditing will operate for the ethics program you have designed. Chapter 10's material on data-driven ethics and compliance functions is directly relevant: the LRN (2024) Ethics & Compliance Program Effectiveness Report, cited in the chapter, finds that companies with strong programs "leverage data from a variety of sources to guide E&C program focus and development as part of ongoing evaluation—including risk analysis, misconduct trends and patterns, root cause analysis data, ethical culture surveys, training content retention, and benchmarking" (p. 11).

A strong compliance-auditing description names concrete audit mechanisms rather than an abstract commitment to "regular audits." Consider specifying: audit frequency (quarterly, annually) and scope (which business units or geographies, tied to the countries you identified in Directive 2); data sources the audit will draw on (helpline/reporting data, training completion and assessment records, exit-interview themes, social media or news monitoring per Chapter 10's environmental-scanning material); who conducts the audit (internal compliance staff, external auditors, or both) and to whom findings are reported (the ethics and compliance officer, the board); and what happens when the audit finds a gap — a corrective-action process, not just a finding.

The final content directive asks for a summary of the paper's key findings — functioning as the substantive core of your conclusion. This is not simply restating the introduction; it is pulling together the paper's actual conclusions: what the risk is and why it matters, what the ethical stakes and stakeholder impacts are, and what the training and auditing plan will accomplish if implemented. A strong summary explicitly returns to the thesis statement from the introduction and shows how the body of the paper supported it.

The outline below maps all nine content directives plus the required title page, introduction/thesis, conclusion, and references page onto an 8–10 page structure, giving each directive its own clearly headed section — both for your own drafting discipline and because clear section headings make it easy for a grader to verify each requirement is met.

1. Title page — bold, title-case title with a space before the rest of the page's information; your name; University of Arizona Global Campus; course name/number; instructor's name; due date. (Not counted in the 8–10 page body.)
2. Introduction — frame your role as a consultant to the new CEO; name your selected risk area and specific risk; end with a clear thesis statement naming your paper's core argument or recommendation.
3. The Emerging Risk (Directive 1) — describe the specific risk using the scale/sensors/sensibilities framework, grounded in a dated, credible source.
4. Countries Associated with the Risk (Directive 2) — identify every country within your defined organizational scope that the risk touches.
5. Country-by-Country Effects (Directive 3) — a differentiated paragraph per country covering regulatory, economic, social, and political context.
6. Ethical Decision-Making Evaluation (Directive 4) — apply Chapter 10's moral-pressure framework or another ethical decision-making model, and take a position.
7. Stakeholder Relationship Analysis (Directive 5) — address employees, customers, suppliers, investors, and communities individually.
8. Why an Ethics Program, Training, and Auditing Are Necessary (Directive 6) — the necessity argument bridging risk analysis to program design.
9. Training Plan (Directive 7) — goals, objectives, learning methods/activities, evaluation, plus a note on delivery logistics.
10. Compliance Auditing Plan (Directive 8) — audit frequency, scope, data sources, responsible parties, and corrective-action process.
11. Conclusion — Key Findings Summary (Directive 9) — synthesize the paper's findings and return explicitly to the thesis.
12. References page — APA-formatted references for the course text and at least 5 additional scholarly/credible sources. (Not counted in the 8–10 page body.)

Map your paper's sections to the assignment's underlying competencies explicitly, since a rubric-aligned paper reads as a series of demonstrated skills rather than a general essay on ethics.

Before submitting, carefully review the Ethics, Compliance Auditing, and Emerging Issues grading rubric under the Settings icon in Canvas and confirm each competency is visibly and specifically addressed, not merely implied by the paper's general subject matter.

• Choosing a risk area you cannot source. Committing to a niche or under-researched risk before confirming five scholarly sources exist stalls the paper mid-week — check source availability on Day 1.
• Treating "identify all countries" as one representative country. The directive is explicitly plural; a paper naming only one country under-delivers on this specific checklist item.
• Duplicating the country-effects paragraphs. If every country's paragraph reads identically with the name swapped, Directive 3's requirement to describe effects on each country is not genuinely met.
• Describing instead of evaluating or analyzing. Directives 4 and 5 use judgment verbs (evaluate, analyze) — a passage that only defines terms or lists frameworks without applying one and reaching a conclusion under-delivers.
• Skipping one of the four training-plan sub-elements. Canvas names goals, objectives, learning methods/activities, and evaluation explicitly — omitting any one leaves a named requirement unaddressed.
• A generic compliance-auditing section unrelated to the specific risk. The audit plan should measure whether the organization is managing your chosen risk specifically, not describe an unrelated generic compliance audit.
• Fewer than 5 outside scholarly sources. The assignment requires at least 5 scholarly sources beyond the course text — this is a higher bar than most other deliverables in the course and is easy to under-shoot if research starts late.
• Skipping the explicit thesis statement. Canvas names this as a specific checklist item for the introduction — an introduction without a clear, identifiable thesis sentence will be marked down independent of the paper's overall quality.
• Running short of or over the page range. 8–10 double-spaced pages excluding title and references pages is both a floor and a ceiling — padding past 10 pages is as much a formatting miss as falling short of 8.

Because this paper is worth 30% of the course grade and demands five outside scholarly sources across a nine-directive structure, the students who do well on it are rarely the ones who start cold in Week 6. A few habits from earlier in the term pay off directly here.

• Throughout the course — Chapter 10's environmental-scanning and stakeholder frameworks build on stakeholder theory and ethical decision-making models introduced in earlier chapters; if those earlier chapters felt shaky, review the relevant deep-dive study guides before Week 6 rather than during it.
• Early in Week 6 (Day 1–2) — read Chapter 10 in full, review Figure 10.4, and lock in your risk area and a scoped organizational scenario before doing any deep research.
• Mid-week (Day 2–4) — front-load the source research. Five scholarly sources plus country-specific data (via the Country Profiles and Database Search Tips library resources) takes real time to assemble; do not leave this until the drafting is underway.
• Late week (Day 5–7) — reserve the final one to two days purely for structure, APA formatting, and a full requirement-by-requirement checklist pass against this guide's Quick Reference table below, rather than still researching at that point.