THE ROLE OF RISK-BASED COMPLIANCE AND THE BRAZILIAN ANTI-CORRUPTION LAW INTRODUCTION

Abstract

The contemporary scenario, marked by globalization and the growing interdependence between states and markets, has required companies to adopt new standards of conduct.

The expansion of business beyond national borders has, as a consequence, created the need to comply with multiple legal frameworks, under penalty of compromising not only profitability but also the very survival of organizations. In this context, integrity or compliance programs play a central role, as instruments designed not only to ensure legal conformity, but also to mitigate operational and reputational risks, often more harmful than state sanctions themselves.

In Brazil, Law No. 12,846/2013 (the Anti-Corruption Law) represented a step forward by establishing incentives for the adoption of integrity programs, such as the reduction of administrative penalties. However, despite recognizing the relevance of compliance, the legislation does not provide clear methodological guidance on the adoption of a risk-based approach), which limits the effectiveness of such programs.

In contrast, foreign legislation has already consolidated the RISK-BASED APPROACH. The UK Bribery Act (2010), for example, by establishing the Six Principles for Adequate Procedures, requires risk assessment as the first step in an effective program.

The Foreign Corrupt Practices Act (FCPA), although it does not directly address the issue in its text, is complemented by enforcement guidelines that instruct companies on risk assessment practices. Nevertheless, the literature emphasizes that risk-based regulation is not neutral: it carries its own vulnerabilities, choices about risk tolerance, modeling flaws, and institutional biases. In this regard, Black and Baldwin argue that effective regulators must be “really responsive,” adjusting their actions not only to formally identified risks but also to the behavior, organizational culture, and institutional reactions of the regulated entities.