You have made a presentation to the Risk Management Committee of your company about the various risks and the mitigation plans thereof. The committee has asked you to formulate the action plan to address the identified r

Once risks are identified, industry members must make a proper assessment of the issues that would arise if incidents occur, and take proportionate steps to minimise the likelihood of such issues resulting in consumer harm. Steps taken need not involve significant resources in advance. Good process planning and/or staff training may have a positive impact on a company's ability to respond effectively when incidents do occur. Even matters that are perceived to be unlikely or appear minor can pose long term difficulties if businesses are under prepared to respond to matters that do arise. The formulation of an action plan could be based on the following: To periodically test and/or monitor certain 'risks' that would normally be associated to a particular service category (e.g., for a subscription service, it may be prudent to test the clarity of promotions, whether reminder messages have been sent, with delivery confirmation noted, and that 'STOP' commands have been properly processed); The frequency of such testing should reflect the risk posed by both the client and the service type. For example, a client with no breach history, or where none of the directors are linked to other companies with breaches, and low-risk service types (such as football score updates), would require far less monitoring than a client with an extensive breach history that provides a high-risk category of service (e.g., a subscription-based lottery alerts system with a joining fee); 'Mystery shopper' testing could be used as, and when, appropriate; Internal mechanisms to enable 'whistle-blowing' by staff, where appropriate; Putting in place internal checks that correlate with unusual patterns of activity which may indicate consumer harm (e.g., spikes in traffic and/or consumer complaints made directly to the provider about one specific service); Having a procedure to alter and address instances of non-compliant behaviour; Monitoring of the client's service to ensure that any directions given by the Phone-paid Services Authority have been complied with; Producing a compliance file, comprising of a written record of the assessment, the subsequent action plan and evidence of any monitoring and/or testing required by the plan having taken place. This record does not necessarily need to be lengthy (although this will depend on the client and the actions taken under the plan), but should be made available to the Phone-paid Services Authority upon request.