A comprehensive ethics program should have structure, ownership, communication, training, monitoring, and enforcement. The CFE Fraud Prevention and Deterrence material identifies several components of an effective ethics program, including a designated ethics official, an ethics task force or committee, ethics training, reporting mechanisms, ethical behavior rewards and sanctions, and periodic evaluation. Option A is therefore correct. Option B is too restrictive because ethics policies and related expectations often need to be communicated to relevant external stakeholders, such as vendors or agents. Option C is incorrect because the program should consider how key stakeholders define success and ethical conduct. Option D is also wrong because sanctions for unethical behavior should be clear and consistently applied. Therefore, option A reflects a best practice.

* Definition of Organizational Crime:
* Organizational crime involves illegal actions conducted by or on behalf of organizations to benefit the organization or its management.
* Why D is Correct:
* Bid rigging is a classic example of organizational crime, where multiple companies collude to manipulate competitive bidding processes for mutual benefit.
* Why Other Options are Incorrect:
* A, B, and C:These represent individual crimes for personal gain, not organizational-level misconduct.
References for All Questions:
* COSO Internal Control-Integrated Framework.
* Criminological theories and studies on deterrence and organizational crime.
* Diane Vaughan's research on organizational factors contributing to deviance.

COSO Internal Control Framework Components:
* The five components are:
* Control Environment
* Risk Assessment
* Control Activities
* Information and Communication
* Monitoring Activities
Why C is Correct:
* Independent oversight, while important in governance, is not explicitly listed as one of the five COSO components. It may relate to broader governance structures but is not a core component of the internal control framework.
References:
* COSO Internal Control-Integrated Framework.