The college cheating scandal hit close to home for us for two reasons. First, the people involved: Aunt Becky (Lori Loughlin), Lynette Scavo (Felicity Huffman), college athletic officials. It turns out they can make bad choices like anyone else. Not to over-moralize in this article (there has been plenty of that online, but the choices were just so wrong on many levels—bad examples for the kids, cheating and corrupting the admissions system), but the facts are really just fascinating. Second, and just as concerning, is how seemingly easy it was for this group of wealthy parents, coaches and a couple of folks knowledgeable about the testing and admissions process to undermine the admission system that parents and kids obsess about for years and that has become the gateway to higher education and, in many ways, the start of the American dream. We share stories of kids that struggle to get into the schools, work hard for years, sacrifice. It turns out it's all for sale. And it's really expensive. OK, but why didn't the schools catch this sort of activity?

An interesting narrative that has not received much, if any, focus is that the schools seem to lack an effective process for detecting such schemes. If you look at the ringleader of the scheme, Rick Singer, who has now pleaded guilty—how was this guy able to pull this off with the help of a few insiders spread around America's most storied schools? Simple. The schools had no process (or at least an ineffective one) for evaluating the risk of and preventing such a scheme.

Universities face all sorts of threats. Privacy of students, campus safety and security, labor and employment issues with faculty, to name just a few. Each university should have a compliance program that should, at a minimum, have a risk assessment process for evaluating compliance risks and the controls in place to mitigate the risks. Fraudulent admissions pose a significant risk for universities because they undermine the integrity of the admissions process and the reputation of the school. The schools have to have a process for identifying and detecting these sorts of emerging threats. We know the schools have effective leadership and strong culture (that is part of what's made them successful). It seems like what may be missing (or at least broken) is a process to think about emerging threats and build in controls and obstacles so that schemes like the pay to play scheme here fail.

We've mapped out the regulatory guidance for compliance available here. Key ingredients of an effective risk assessment process include understanding regulatory requirements, risk identification, assessment of controls, development of mitigation plans and monitoring. Compliance programs cannot stop people from committing crimes, but if they make it difficult with controls and monitoring, that can be a strong deterrent. Companies routinely implement processes that monitor transactions, communications and other data for potential illegal conduct. For the schools involved who know that admission is the ultimate prize, it seems like common sense that if you have something valuable, people will try to steal it, so you have to make it more difficult.

We don't know all the facts here and the allegations are just allegations at this point (the only person to plead guilty was Singer). But given the number of schools involved, it seems like something more systematic may be wrong with these schools. It can't be this easy to beat the system, can it?

Ryan McConnell and Meagan Baker are lawyers at R. McConnell Group—a compliance and internal investigations boutique law firm in Houston, Texas. McConnell is a former assistant U.S. Attorney in Houston who has taught criminal procedure and corporate compliance at the University of Houston Law Center. Baker's work at the firm focuses on risk and compliance issues in addition to assisting clients with responding to compliance failures. Send column ideas to [email protected]. Follow the firm on Twitter at @rmcconnellgroup.