On this page
- What a compliance risk assessment actually covers
- Start by scoping the universe of obligations, products and processes
- Find the risk points before you score anything
- Use a scoring model people can defend in a board meeting
- Test your controls instead of assuming they work
- Turn the findings into a risk-based compliance monitoring plan
- Download the free template and customize it for your team in under an hour
A weak risk assessment is expensive, and regulators keep getting better at spotting one. ACFE’s 2024 Report to the Nations says organizations lose an estimated 5% of revenue to fraud each year. PwC’s Global Compliance Survey 2025 found that 64% of CEOs see regulation as a barrier to reinvention. The U.S. Department of Justice’s Evaluation of Corporate Compliance Programs, updated in September 2024, still asks three blunt questions that travel well across jurisdictions: is the program well designed, is it adequately resourced and empowered to function effectively, and does it work in practice?
That matters even more now that evidence is harder to fake and easier to trace. On May 6, 2026, Google announced new link treatments and subscription-linked source highlights inside AI Mode and AI Overviews. At the same time, publisher pressure over attribution and traffic impact kept rising in Europe, and new research continued to examine what AI summaries do to clicks and source visibility. We spend our days at EasilyGeo. See how AI search talks about your brand, showing teams which sources AI engines cite and which they skip. The same principle applies to compliance work: if you cannot trace a score back to a rule, a process, and tested evidence, the document will not hold up when leadership or a regulator asks follow-up questions.
In this guide, we’ll walk through a practical compliance risk assessment from scope to board pack. We’ll also show a worked example from start to finish and give you a free template structure you can adapt fast.
What a compliance risk assessment actually covers
A compliance risk assessment looks at the chance that your business breaks a law, regulation, internal policy or conduct standard and the damage that follows. That damage can show up as fines, license restrictions, litigation, customer harm, operational disruption or reputational loss. Basel’s long-used definition centers on legal or regulatory sanctions, financial loss and reputational loss. More recent research from Petra Benedek and Ferenc Bognár adds a useful point for modern teams: compliance risk is about both mandatory rules and voluntary obligations, and it needs a structured process for identification, analysis, evaluation and treatment.
This is broader than enterprise risk management and different from a one-off compliance assessment. ERM asks what could hurt the whole business across strategy, operations, finance and more. A compliance risk assessment asks where noncompliance is most likely, most severe and least controlled. Routine compliance assessments may test a policy area, a branch, a business unit or a single control. Strong compliance risk assessments decide where those narrower reviews should go first.
For teams in India, scope setting usually starts with the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 published on November 14, 2025, then expands to sector rules that fit the business model. A lender may need RBI digital lending, outsourcing, and IT governance requirements. A listed intermediary may need SEBI AML, disclosure, or outsourcing rules. An insurer may need IRDAI governance and risk management requirements. Rules differ by sector and activity, so map what applies to your business model before you score anything.
Start by scoping the universe of obligations, products and processes
Our compliance risk assessment methodology starts with one inventory that everything else points back to. If that base is messy, every score after it becomes an argument instead of a decision.
Build an obligations inventory from laws, regulations, regulator circulars, contracts, codes of conduct and material internal policies.
Map business lines, legal entities, products, services, channels and geographies that each obligation touches.
Document the processes where failure can actually happen, such as onboarding, marketing approval, payments, collections, vendor onboarding, complaint handling and regulatory reporting.
Name an owner for each process and a challenger from compliance or legal.
Pull the evidence you already have: policies, SOPs, prior incidents, hotline cases, audit findings, complaints, training records and regulator correspondence.
Keep the same inventory for your future risk-based compliance monitoring plan so remediation, testing and re-scoring happen in one place instead of three disconnected files.
A simple worksheet is enough at first. Use columns for regulation, clause or topic, affected process, owner, geography and evidence source. Benedek and Bognár’s review argues for structured reuse of information across compliance, operational risk and internal audit. The FCA makes the same point in practice: risk assessments work better when they feed wider risk appetite, controls testing and tracked actions instead of sitting as a dead annual exercise.
Find the risk points before you score anything
Risk identification is where the assessment becomes real. Ask where misconduct, disclosure failures, privacy breaches, licensing breaches, mis-selling, sanctions screening gaps, recordkeeping failures or third-party lapses could happen. Then map the contact points: customer onboarding, app consent flows, marketing claims, sales incentives, vendor onboarding, data handling, invoicing, complaint handling and reporting to regulators. Prior incidents, whistleblower reports, audit findings, near misses, complaint themes and changes in law are usually more useful here than generic brainstorming. DOJ’s current guidance also pushes companies to show how they identify changing risks, including risks linked to new technologies and outsourced processes.
Write the risks as cause-and-consequence statements. For example: if consent capture fails in the mobile app, then personal data may be processed unlawfully under the DPDP framework; if APR and fee disclosures in ads are incomplete, then customers may be misled and complaints or supervisory action may follow; if KYC exceptions are cleared without evidence, then restricted or synthetic customers may be onboarded; if sanctions screening logs are incomplete, then a prohibited counterparty may slip through; if a collection agency uses unapproved scripts, then borrower harm and conduct breaches may follow; if complaint escalation fails, then recurring issues may be reported late or not at all.
Use a scoring model people can defend in a board meeting
A defensible scoring model uses anchors, not adjectives. Set likelihood on a 1 to 5 scale tied to observable frequency bands. For example, 1 means rare and not seen in the last three years, 3 means plausible and seen at least quarterly in the business or peer incidents, and 5 means frequent or already recurring monthly or weekly. Do the same for impact. We usually weight four dimensions: legal or regulatory harm, customer harm, operational disruption and reputational damage. For a consumer-facing regulated business, a practical starting weight is 35% legal, 30% customer, 20% operational and 15% reputational. Then define risk appetite thresholds up front, such as 1 to 6 monitor, 8 to 12 management action, and 15 to 25 executive or board escalation.
Keep inherent risk and residual risk separate. Inherent risk is the exposure before you give credit for controls. Residual risk is what remains after you test whether the controls are designed well and actually operate. Benedek and Bognár’s 2024 literature review is useful here because it highlights two recurring failures: inconsistent methodology across firms and a habit of blending control quality into impact scoring too early. Their earlier work also showed that structured expert comparison can quantify agreement and improve consistency in scoring workshops.
Calibration is what makes the numbers believable. Run a workshop with written scoring guidance. Have two raters score the highest-risk items independently before the group meets. Compare differences. Resolve boundary cases in writing. Save two or three sample “gold standard” cases for future refreshes. Then back-test your scales against what actually happened in complaints, incidents, and audit findings. Regulators keep circling back to this. DOJ’s September 2024 ECCP asks how the company identifies risks, whether the program is a paper program or a tested one, and whether it evolves with lessons learned. The U.S. Sentencing Guidelines still emphasize monitoring, auditing, and periodic evaluation. The FCA’s 2025 findings on firms’ risk assessments stress planning for compliance alongside growth and formally tracking actions. The SEC’s 2026 examination priorities continue the same risk-based logic in areas like privacy, cybersecurity and new rules.
Test your controls instead of assuming they work
Once the raw risks are listed, move to control assessment. Document preventive controls versus detective controls, manual controls versus automated controls, the owner, the frequency, the evidence retained, and any known gaps. That can include approval workflows, sanctions screening logs, consent records, training completion reports, reconciliations, exception reporting, and vendor due diligence files. A control that exists in a policy but leaves no evidence trail will be hard to defend. DOJ explicitly asks whether companies have enough staff and data to audit, document, analyze, and use the results of their compliance efforts.
Rate control design effectiveness and operating effectiveness separately. Design asks whether the control could prevent or detect the issue if used properly. Operating asks whether it actually happened at the promised frequency and with usable evidence. That distinction is especially important in outsourced and technology-heavy environments. RBI’s outsourcing and IT governance directions both push regulated entities to assess third-party dependencies, vendor risk and control effectiveness with evidence that remains available to the entity and the regulator. Software can help later, but many teams can get a strong first pass from a disciplined spreadsheet with clear evidence links.
Turn the findings into a risk-based compliance monitoring plan
The assessment is only useful when it drives a risk-based compliance monitoring plan. Start with residual risk and control weakness, not with calendar convenience. Under the three lines model, the first line owns the process and the fix, the second line owns the methodology, challenge, and monitoring, and the third line gives independent assurance. Link each high-risk item to the control library, KRIs, policy exceptions, audit coverage, incidents, complaints, and training plans. Good KRIs are specific enough to move before the breach becomes public: consent-log failure rate, KYC exception volume, percentage of marketing assets without current approval, vendor complaint rate per 1,000 accounts and aged remediation items over 30 days. DOJ, the Sentencing Guidelines and the FCA all point in the same direction here: monitoring, auditing, root-cause analysis and tracked actions are what make a program credible.
A simple 90-day roadmap works well. In days 1 to 30, design remediation and gather evidence: responsible process owner, accountable business head, consulted compliance, legal and IT, informed audit committee, sponsor. In days 31 to 60, fix the control gaps, update procedures, and train the teams that actually touch the risk. In days 61 to 90, start live monitoring, collect the first month of KRI data, and rescore the top risks. After that, set a cadence: monthly management review for red and high-amber items and quarterly board or committee reporting. Reassess sooner when a new product launches, a major incident happens, a regulator sends a notice, a merger closes, a material outsourced process changes, or the law changes. Strong programs are not static. They are versioned, evidenced, and re-tested.
Download the free template and customize it for your team in under an hour
Our free compliance risk assessment template is built to get the first workshop moving without turning the exercise into a software project. It includes tabs for the obligations inventory, process map, risk register, scoring guide, control library, heat map, and monitoring plan. Bring compliance, legal, operations, product, IT and internal audit if you have it. Fill in the obligations first, map the high-risk processes next, then score only the top risks you can evidence.
Download our free compliance risk assessment template, run your first scoring workshop, and build a monitoring plan your leadership team can actually use.
