Compliance risk is the risk of legal or regulatory sanctions, financial loss or reputational damage that an organisation suffers when it fails to comply with laws, regulations, rules, codes of conduct and standards of good practice that apply to its activities. It is the risk category with the widest span (every law that touches the business), the one most often confused with the function that manages it, and the one where the gap between a program that exists on paper and a program that works is hardest to see from the outside. This is the Risk Library reference on the subject: what compliance risk is and how it differs from compliance, conduct risk and legal risk; where it comes from; how it is assessed and measured; what a compliance management system contains and what regulators expect of it; the regulatory change and complaint processes that feed it; how compliance monitoring, compliance testing and internal audit divide the work; where enforcement attention sits in 2026; and a worked compliance risk management audit at an illustrative nine-billion-dollar bank.
It absorbs the former short explainer on compliance versus compliance risk as its second section, and it is the reference behind three engagement guides: the compliance risk assessment method, the ethics and compliance program audit and the BSA/AML independent testing program.
In this guide
- What compliance risk is
- Compliance versus compliance risk, conduct risk and legal risk
- Where compliance risk comes from
- Assessing compliance risk: the inherent and residual map
- The compliance management system and what regulators expect
- Regulatory change management
- Complaints: the data the program runs on
- Monitoring, testing and audit: who does what
- Metrics and reporting
- Where enforcement attention sits in 2026
- How internal audit tests compliance risk management
- Worked example: Lakeshore Bancorp’s FY27 compliance audit
- Frequently asked questions
- Related guides
What compliance risk is
The Basel Committee’s 2005 paper on compliance and the compliance function in banks gave the definition most frameworks still use: the risk of legal or regulatory sanctions, material financial loss, or loss to reputation a bank may suffer as a result of its failure to comply with laws, regulations, rules, related self-regulatory organisation standards, and codes of conduct applicable to its banking activities. The Office of the Comptroller of the Currency’s version is shorter and makes the same point: the risk to current or projected financial condition and resilience arising from violations of laws, rules or regulations, or from non-conformance with prescribed practices, internal policies and procedures, or ethical standards. Three features of the definitions matter for anyone measuring or auditing the risk.
First, the consequence is defined broadly: sanctions, financial loss and reputational damage, which means a compliance failure with no fine can still be a material compliance event. Second, the scope includes codes of conduct and internal policies, not only law, which is why conduct risk and compliance risk overlap and why an organisation’s own standards become compliance obligations once adopted. Third, the risk attaches to activities, so it is inherent in what the organisation does and cannot be eliminated by the compliance function, only managed by the business with the function’s help. The risk taxonomy guide shows where compliance risk sits among the other categories, and the OCC risk categories guide how the OCC places it alongside strategic, reputation and operational risk.
Compliance versus compliance risk, conduct risk and legal risk
Four terms are run together in most organisations, and separating them is the first thing an auditor does when scoping any engagement in this area.
| Term | What it means | Example | Why the distinction matters |
|---|---|---|---|
| Compliance | The state of conforming to the applicable obligations; also the function that supports conformance | “The bank is in compliance with the flood insurance rules”; “compliance reviewed the disclosure” | Compliance is an outcome or a function; it is not the risk. Auditing “compliance” without saying which obligations is unscopeable |
| Compliance risk | The risk that the organisation fails to conform and suffers sanctions, loss or reputational damage | The risk that a new deposit product’s fee disclosures violate Truth in Savings | The thing that is assessed, measured, limited and reported; the business owns it |
| Conduct risk | The risk that the organisation’s or its people’s behaviour produces poor outcomes for customers, markets or the organisation, whether or not a rule is broken | Selling a suitable product with pressure tactics; a sales incentive that drives unneeded accounts | Conduct failures often precede rule changes; the UK framework treats conduct as its own category. The conduct risk guide covers it |
| Legal risk | The risk of loss from unenforceable contracts, litigation, adverse judgments or defective legal documentation | A guarantee that is unenforceable because it was signed without authority | Managed by the legal function; overlaps with compliance where litigation follows a compliance failure |
| Regulatory risk | The risk that regulation changes in ways that affect the business model or its cost | A rule capping a fee the business depends on | A strategic risk about the future rulebook, not a failure to comply with the current one |
The distinction that causes the most trouble in practice is the first: an organisation with a compliance function is not therefore managing compliance risk, any more than an organisation with an accounting department is therefore managing financial reporting risk. The function assesses, advises, monitors and reports; the business lines own the risk, embed the controls and are accountable for the outcomes. An audit that finds a well-staffed compliance function and a business that treats compliance as someone else’s job has found the most common compliance finding there is.
Where compliance risk comes from
Compliance risk is inherent in activities, and the inventory of obligations is the starting point of any assessment. The table groups the main sources for a financial institution, with the obligations that generate most of the risk in each and the business activities that carry it; a non-financial organisation substitutes its own regulatory map (employment, environmental, product safety, data protection, anti-corruption, trade sanctions, sector licensing).
| Source | Representative obligations (US unless noted) | Activities that carry the risk | Typical failure |
|---|---|---|---|
| Consumer protection | Truth in Lending, Truth in Savings, Equal Credit Opportunity, Fair Housing, Fair Credit Reporting, Electronic Fund Transfer, Real Estate Settlement Procedures, UDAAP, Servicemembers Civil Relief, Flood Disaster Protection | Deposit and lending products, servicing, collections, marketing | Disclosures that do not match the product as built; fee practices; fair lending disparities |
| Financial crime | Bank Secrecy Act and AML program rules, OFAC sanctions, anti-bribery (FCPA, UK Bribery Act), fraud statutes | Onboarding, payments, correspondent banking, trade finance, third-party agents | Alert backlogs; weak customer due diligence; sanctions screening gaps; see the BSA/AML testing guide |
| Privacy and data | Gramm-Leach-Bliley, state privacy laws, GDPR and UK GDPR for EU and UK data, breach notification rules | Every customer data flow; marketing; vendors | Data shared beyond the notice; breach notifications late |
| Prudential and safety and soundness | Capital and liquidity rules, lending limits, affiliate transaction rules (Regulation W), insider lending (Regulation O), call reporting | Treasury, lending, finance, regulatory reporting | Reporting errors; limit breaches; affiliate transactions undocumented |
| Securities and markets | Securities Exchange Act rules for broker-dealers, investment adviser rules, market conduct rules, Volcker Rule | Capital markets, wealth management, trust | Suitability; best execution; proprietary trading boundaries |
| Employment and workplace | Wage and hour, anti-discrimination, health and safety, whistleblower protection | Human resources, every manager | Misclassification; retaliation |
| Conduct and ethics | Codes of conduct, gifts and entertainment, conflicts of interest, insider trading policies | Everyone; sales incentives; front office | Incentive-driven mis-selling; undisclosed conflicts |
| Governance obligations | Sarbanes-Oxley certifications, listing rules, board composition and committee requirements | Finance, legal, the board | Certification processes that are ceremonial |
Two sources deserve a note because they are growing. Third parties carry the organisation’s compliance obligations into places the organisation does not see: a fintech partner originating accounts, a collection agency, a marketing vendor; the third-party risk management guide and the Third-Party Topical Requirement address the governance, and compliance risk assessments should include the third-party channel explicitly. And artificial intelligence in customer-facing processes (credit decisions, marketing, servicing chatbots) creates compliance exposure under existing fair lending, UDAAP and privacy rules before any AI-specific rule applies; the auditing AI governance guide covers the control framework.
Assessing compliance risk: the inherent and residual map
A compliance risk assessment is a matrix: obligations (or regulatory areas) down the side, business units or products across the top, and in each cell an inherent risk rating, a control effectiveness rating and the residual risk that results. The compliance risk assessment guide works through the method step by step; the summary here is what the assessment must contain to be credible and the ways it goes wrong.
| Element | What good looks like | What weak looks like | Audit test |
|---|---|---|---|
| Obligation inventory | A maintained inventory of applicable laws, rules and standards mapped to products, processes and owners, with a defined process for additions | A list copied from a vendor library with no mapping to the business | Trace a sample of obligations to owners and controls; check that recent rule changes appear |
| Inherent risk scoring | Scored on defined factors: volume, complexity, change, customer harm potential, enforcement history, penalties | Everything scored medium; scores unchanged for years | Test the scoring rationale for the ten highest and ten lowest cells |
| Control assessment | Controls identified per obligation; design and operating effectiveness supported by monitoring and testing results | Controls rated effective because they exist | Trace control ratings to monitoring and testing evidence |
| Residual risk and appetite | Residual risk compared to a stated appetite; high residual cells have action plans with owners and dates | Residual risk reported with no consequence | Confirm action plans exist for high residual cells and are tracked |
| Refresh cadence | Annual refresh plus triggers: new product, acquisition, rule change, enforcement action, significant complaint trend | Annual only; new products launched between refreshes unassessed | Check that products launched in the year were assessed before launch |
| Use | The assessment drives the monitoring plan, the testing plan, training priorities and the audit plan | The assessment is produced for the board and filed | Compare the monitoring and testing plans to the assessment’s high-risk cells |
The assessment’s purpose is allocation: it decides where compliance monitoring and testing, training and audit hours go. An assessment that does not change any of those allocations is a report, not a risk assessment, and an internal auditor reads the monitoring plan against the assessment to see whether the function believes its own numbers.
The compliance management system and what regulators expect
US regulators describe the architecture they expect as a compliance management system (CMS), and the elements are consistent across the FFIEC examination manuals, the CFPB’s supervision manual and the OCC’s guidance: board and management oversight; a compliance program consisting of policies and procedures, training, monitoring and corrective action; a consumer complaint response process; and an independent compliance audit. For the largest banks the OCC’s heightened standards (for institutions with average total assets of 50 billion dollars or more) and the Federal Reserve’s 2008 guidance on compliance risk management programs at large banking organisations add expectations of firm-wide compliance risk management, an independent compliance function with a reporting line to the board or a board committee, and a compliance risk assessment that spans the enterprise. Outside banking the architecture is the same under different names: the US Sentencing Guidelines’ seven elements of an effective compliance and ethics program, the Department of Justice’s evaluation of corporate compliance programs (most recently updated in September 2024, with new attention to the use of data, to AI risk and to whistleblower treatment), the UK FCA’s systems and controls sourcebook, and ISO 37301 on compliance management systems.
| Element | What regulators look for | Evidence an auditor asks for | Frequent gap |
|---|---|---|---|
| Board and management oversight | Board approves the program and appetite; receives risk assessment, monitoring and testing results, complaint trends, regulatory change; a qualified chief compliance officer with independence and stature | Charter, board and committee minutes, CCO reporting line and appraisal, resourcing analysis | Board sees a status dashboard but not the risk assessment or testing results; CCO reports to the general counsel or the business |
| Policies and procedures | Current, mapped to obligations, approved, communicated, with exceptions governed | Policy inventory with review dates and owners; mapping to the obligation inventory | Policies that describe the rule rather than the bank’s process; stale review dates |
| Training | Role-based, risk-based, tracked, with completion and comprehension measured | Training plan tied to the risk assessment; completion records; test results | Annual generic modules for everyone; completion tracked, comprehension not |
| Monitoring | First-line and compliance-function monitoring of transactions, disclosures and processes against the obligations, risk-based in frequency and depth | Monitoring plan, results, issues raised | Monitoring that confirms a checklist was completed rather than that the outcome was compliant |
| Testing | Independent, sample-based compliance testing by the compliance function (distinct from monitoring and from internal audit) | Testing plan tied to the risk assessment; workpapers; findings; sample sizes | Testing of low-risk areas because they are easy; no retesting of remediated issues |
| Issue management and corrective action | Issues from any source tracked to root cause and remediation with owners, dates and validation; self-identification credited | Issue log, root cause analyses, validation evidence | Issues closed on management assertion; repeat issues not flagged |
| Complaint response | Complaints captured from every channel, categorised, root-caused, trended and escalated | Complaint data, categorisation rules, trend reports | Complaints handled but not analysed |
| Compliance audit | Internal audit coverage of the CMS and of high-risk obligations, independent of compliance | Audit universe, plan, reports | Audit relies on compliance testing without testing it |
Regulatory change management
The obligation inventory decays from the day it is written, and regulatory change management is the process that keeps it current: identifying new and amended obligations, assessing applicability and impact, assigning owners, implementing changes to policies, systems, disclosures and training, and confirming the change landed before the effective date. The process has a recognisable set of controls and a recognisable set of failures.
| Step | Control | Evidence | Failure that recurs |
|---|---|---|---|
| Horizon scanning | Defined sources (agency releases, Federal Register, state regulators, trade bodies, vendor feeds) reviewed on a schedule with a log | Change log with source, date identified and date of effect | Sources limited to one vendor feed; state rules missed |
| Applicability and impact assessment | Each change assessed for applicability, affected products and processes, and effort, by a named owner, within a set time | Assessment record per change | Changes marked “not applicable” without rationale |
| Implementation | Project or task tracking with owners and dates against the effective date; system, policy, disclosure and training changes itemised | Project records, change tickets, policy versions | Implementation complete on the effective date in policy but not in the system |
| Pre-effective validation | Compliance testing or monitoring confirms the change operates before or shortly after the effective date | Validation workpapers | No validation; the first evidence of failure is a complaint or an exam finding |
| Inventory update | Obligation inventory and risk assessment updated for the change | Inventory version history | Inventory updated annually, months after the change |
An audit of regulatory change management is a tracing exercise: select ten changes from the year with effective dates in the period, and follow each from identification through assessment, implementation and validation to the inventory, measuring elapsed time at each step against the effective date. The findings write themselves when a change identified in March took effect in July and was implemented in the system in October.
Complaints: the data the program runs on
Complaints are the richest data source a compliance program has, because customers report the failures that monitoring did not catch, and regulators treat complaint handling and complaint analytics as a core CMS element. The program needs capture from every channel (branches, call centres, digital, social media, regulators, the CFPB portal where applicable, legal), consistent categorisation by product and issue, root cause analysis for recurring categories, trend reporting with thresholds, and escalation of complaints that allege discrimination, UDAAP, or harm to vulnerable customers. The audit tests are completeness (are complaints from every channel reaching the system; sample call recordings and social media for unlogged complaints), categorisation accuracy (re-categorise a sample), timeliness (response times against policy and regulation), root cause (are the top categories traced to a cause and an action), and use (does the complaint trend change the risk assessment and the monitoring plan). A function that reports complaint volumes without root causes has a reporting system, not a compliance control.
Monitoring, testing and audit: who does what
Compliance assurance has three layers, and confusion between them produces both gaps and duplication. The internal audit versus compliance guide covers the relationship in full; the table summarises the division of labour and the reliance rules.
| Layer | Who | What | Independence | How internal audit uses it |
|---|---|---|---|---|
| Monitoring | First line (business quality control) and the compliance function | Ongoing checks of transactions, disclosures and processes as they occur; high frequency, broad coverage | First-line monitoring is not independent; compliance monitoring is independent of the business but part of the program | Evidence of control operation; tested rather than relied on |
| Compliance testing | The compliance function’s testing team | Periodic, sample-based, independent tests of compliance with specific obligations, planned from the risk assessment | Independent of the business and of monitoring; part of the second line | Reliance possible after testing the testing: methodology, sample sizes, competence, independence, and reperformance of a sample |
| Internal audit | Third line | Audits the CMS as a system and audits high-risk obligations directly; opines to the audit committee | Independent of both | Owns the opinion on the program; coordinates coverage with testing to avoid gaps and duplication |
The reliance decision follows the same logic as reliance on credit risk review or on model validation, covered in the auditing ERM guide: internal audit may reduce direct testing where the compliance testing function is independent, competent and its work has been tested, and must document that conclusion annually. It cannot rely where testing reports to the business, where the testing plan omits the high-risk cells, or where sample sizes cannot support the conclusions drawn.
Metrics and reporting
Compliance risk reporting to the board and the risk committee should show the level and trend of the risk, not the activity of the function. The distinction is the difference between “training completion 98 per cent” and “two of the twelve high-residual-risk cells have overdue action plans”. The key risk indicator program guide and the KRI tables give the general method; the table lists the indicators a compliance report should carry.
| Indicator | What it shows | Threshold logic | Weak substitute |
|---|---|---|---|
| High residual risk cells with overdue actions | Whether the assessment is driving remediation | Any overdue action is reportable; trend matters | Count of policies reviewed |
| Issues by source (self-identified, monitoring, testing, audit, examiner, complaint) and age | Whether the program finds its own problems before regulators do | Examiner-identified share rising is a program failure | Count of open issues |
| Repeat issues | Whether remediation holds | Any repeat is reportable | Issues closed |
| Complaints per thousand accounts by product, with allegation categories (discrimination, UDAAP, fees) | Customer-reported failures | Thresholds by product; spikes investigated | Total complaints |
| Regulatory changes past effective date without validated implementation | Change management performance | Zero is the target | Changes logged |
| Monitoring and testing plan completion against the risk-based plan, with exceptions found | Whether the assurance layers are operating | Deferred tests of high-risk cells reportable | Tests completed |
| Training: comprehension and role coverage for high-risk roles | Whether people know the rules that apply to them | Comprehension below threshold in a high-risk role is reportable | Completion rate |
| Regulatory matters: MRAs, consent orders, fines, exam ratings, with status | The external verdict | Any open matter reportable with milestones; see the MRA lifecycle guide | Narrative only |
Where enforcement attention sits in 2026
A reference guide should say where the risk is being enforced at the time of writing, because an audit plan that ignores the enforcement environment allocates hours to the wrong obligations. Four observations hold in 2026. Federal consumer financial enforcement in the United States changed shape in 2025: the Consumer Financial Protection Bureau’s staffing, guidance and enforcement footprint were cut back sharply, several actions and interpretive rules were withdrawn, and the prudential regulators and state attorneys general became the more active consumer enforcers; a program that calibrated its risk assessment to CFPB activity alone has mis-scored the risk, because the underlying statutes did not change and state enforcement and private litigation did not slow. Financial crime enforcement did not pause: AML program failures, sanctions violations and the fintech partnership model (banks providing accounts and payments for third-party programs) produced consent orders through 2024 and 2025, and third-party and partner oversight is the obligation most often cited. Fair lending remains a live exposure through the Equal Credit Opportunity Act and the Fair Housing Act regardless of agency priorities, and the use of models and AI in credit decisions has become a standard examination question. And the Department of Justice’s September 2024 update to its compliance program evaluation added questions about whether companies use data analytics in compliance, manage the risks of AI and emerging technology, and protect whistleblowers, which corporate compliance programs outside financial services now have to answer.
How internal audit tests compliance risk management
A compliance risk management audit tests the system, not the obligations one by one; obligation-level audits (fair lending, BSA/AML, flood, servicing) are separate engagements in the universe, as the bank audit universe example shows. The program has nine areas, mapped to the CMS elements, and the ethics and compliance program audit guide gives the non-financial version.
| Area | Key tests | Evidence | Typical finding |
|---|---|---|---|
| Governance | CCO reporting line, independence and stature; board reporting content; resourcing against the risk assessment | Charter, org chart, minutes, reports | CCO reports to the general counsel; board receives activity metrics only |
| Risk assessment | Inventory completeness; scoring rationale; refresh triggers; use in planning | Inventory, assessment, monitoring and testing plans | Assessment not used to plan monitoring or testing |
| Policies and training | Mapping to obligations; currency; role-based training tied to risk | Policy inventory, training plan and results | Generic training; policies restate the rule |
| Monitoring | Design against the obligation; results; issues raised; first-line versus compliance monitoring | Monitoring plan and results | Checklist monitoring that cannot detect outcome failures |
| Testing | Plan against the risk assessment; methodology; sample sizes; reperform a sample of tests | Testing plan, workpapers | Testing of convenient areas; samples too small |
| Regulatory change | Trace ten changes end to end against effective dates | Change log, assessments, implementation records | Implementation after the effective date; no validation |
| Complaints | Completeness across channels; categorisation; root cause; use | Complaint data, call samples, trend reports | Unlogged complaints in call recordings; no root cause |
| Issue management | Root cause; remediation validation; repeat issues; examiner findings tracked | Issue log, validation evidence | Issues closed on assertion; repeats |
| Reliance and coordination | Internal audit’s reliance on compliance testing documented and supported | Reliance memo, test of testing | Reliance without testing the testing |
The three most informative procedures are reperformance of a sample of compliance tests (does the testing team’s conclusion hold when the auditor re-does the test), the end-to-end trace of regulatory changes, and the complaint completeness test using call recordings and social media, because each tests an outcome the program claims rather than a document the program produced. The audit work program guide covers documentation and the what regulators expect guide how an examiner will read the function’s coverage.
Worked example: Lakeshore Bancorp’s FY27 compliance audit
Lakeshore Bancorp is the illustrative nine-billion-dollar public regional bank used across this site, with a twenty-two person internal audit function and a compliance department of about forty. Its FY27 plan scheduled a 520-hour audit of the compliance risk management program, the first system-level audit since FY24; obligation-level audits (BSA/AML, fair lending, mortgage servicing) ran on their own cycles. The engagement followed the program above.
| Area | What the audit found | Rating |
|---|---|---|
| Governance | The chief compliance officer reported to the general counsel with a dotted line to the board risk committee; the committee received a quarterly dashboard of training completion, policy reviews and complaint volumes, and had not seen the compliance risk assessment since FY25 | High: independence and reporting |
| Risk assessment | Inventory of 214 obligations mapped to products and owners, refreshed annually; 38 of 61 high-inherent-risk cells rated “effective controls” with no monitoring or testing result in the prior twelve months to support the rating; the FY27 monitoring plan covered 19 of the 61 | High: control ratings unsupported; plan not driven by the assessment |
| Regulatory change | Ten changes traced: median 41 days from identification to assessment; three changes implemented in systems after their effective dates (by 23, 48 and 95 days); none validated before the effective date; one state servicing rule missed because the scanning sources covered federal releases only | High |
| Complaints | A sample of 120 call recordings produced 9 complaints meeting the policy definition that were not logged (7.5 per cent); social media not monitored; top three categories trended but not root-caused | Medium |
| Testing | Twenty tests reperformed: eighteen conclusions supported; two fee-disclosure tests used samples of five accounts and concluded “no exceptions” on populations above 20,000 | Medium: sample sizes |
| Issue management | Of 44 issues closed in the year, 31 closed on management’s assertion without validation; four were repeats of FY25 issues | Medium |
| Training | Completion 97 per cent; comprehension measured only on the ethics module; mortgage originators had no role-based fair lending training beyond the general module | Low |
| Reliance | Internal audit’s FY26 fair lending audit had relied on compliance testing results without testing the testing; the reliance memo was written after the fact | Medium (self-identified) |
The engagement was rated Needs Improvement with three High findings. Management’s actions: a direct reporting line from the chief compliance officer to the board risk committee, effective at the next board meeting, with the risk assessment and testing results on the committee’s standing agenda; a re-rating of the 61 high-inherent-risk cells against actual monitoring and testing evidence, with the FY27 testing plan reset to cover every high-residual cell; a regulatory change procedure with a ten-day assessment standard, state-regulator sources added to the scan, and pre-effective-date validation; a complaint capture refresh with speech analytics on call recordings; and a sample size standard for compliance testing. Internal audit’s own reliance practice was corrected with a documented test-of-testing each year before any reliance. The findings were validated under the issue validation standard, with the regulatory change finding validated by tracing the next ten changes.
Frequently asked questions
What is the difference between compliance and compliance risk?
Compliance is the state of conforming to the obligations that apply to the organisation, and by extension the function that supports conformance. Compliance risk is the risk that the organisation fails to conform and suffers sanctions, loss or reputational damage as a result. The business owns the risk; the compliance function assesses, advises, monitors, tests and reports. An organisation can have a compliance function and still manage compliance risk badly, which is the most common finding in this area.
What is a compliance management system?
The architecture US regulators expect for managing compliance risk: board and management oversight, a compliance program (policies and procedures, training, monitoring and corrective action), a consumer complaint response process, and an independent compliance audit. The FFIEC examination manuals and the CFPB supervision manual describe it in those terms; the OCC’s heightened standards and the Federal Reserve’s guidance on compliance risk management programs add enterprise-wide expectations for large banks. Outside banking the equivalent is the US Sentencing Guidelines’ seven elements and the Department of Justice’s compliance program evaluation.
How is compliance risk measured?
Through the compliance risk assessment: inherent risk scored on defined factors for each obligation and business unit, control effectiveness supported by monitoring and testing evidence, residual risk compared to appetite, and action plans for high residual cells. The measure is only as good as the evidence behind the control ratings, and the assessment is only useful if it drives the allocation of monitoring, testing, training and audit hours. The compliance risk assessment guide works through the method.
What is the difference between compliance monitoring, compliance testing and internal audit?
Monitoring is ongoing checking of transactions and processes as they occur, by the first line and the compliance function. Testing is periodic, sample-based, independent testing of specific obligations by the compliance function’s testing team, planned from the risk assessment. Internal audit is the third line, which audits the compliance management system as a whole and high-risk obligations directly, and may rely on compliance testing only after testing it. The internal audit versus compliance guide covers the relationship.
Does conduct risk belong under compliance risk?
They overlap and are managed together in most organisations, but they are distinct: compliance risk is about failing to meet obligations; conduct risk is about behaviour that produces poor outcomes for customers or markets whether or not a rule is broken, and it often precedes the rule. UK regulators treat conduct as its own category; US frameworks tend to capture it through UDAAP and codes of conduct. The conduct risk guide treats it on its own terms.
How should a compliance program respond to the changes in US enforcement since 2025?
By recognising that the obligations did not change when the enforcer’s posture did. The statutes behind consumer protection, fair lending, financial crime and privacy remain in force, state attorneys general and prudential regulators are active, private litigation continues, and administrations change. A risk assessment that lowered inherent risk scores because one agency stepped back has mis-scored the risk; the defensible response is to hold the scores to the law and the harm potential, and to track the enforcement environment as context rather than as the measure.
What should the board see about compliance risk?
The level and trend of the risk rather than the activity of the function: the risk assessment and its high residual cells with action status; issues by source and age, with the share found by regulators rather than by the program; repeat issues; complaint rates and allegation categories by product; regulatory changes past their effective date without validated implementation; monitoring and testing completion against the risk-based plan; and the status of every regulatory matter. Training completion and policies reviewed are inputs, not outcomes.
How often should internal audit cover the compliance management system?
As a system, every two to three years with annual coverage of the highest-risk obligations and continuous monitoring of the indicators above in between; annually for large banks under heightened standards, where examiners expect audit’s coverage of the compliance program to be explicit. The bank audit universe example shows how the system-level audit and the obligation-level audits are sequenced.
Related guides
- Compliance Risk Assessment — the step-by-step method for the inherent and residual risk map
- Ethics and Compliance Program Audit — the non-financial version with the Tamarack Stores example
- Internal Audit vs Compliance — roles, lines and reliance between the two functions
- BSA/AML Independent Testing — the financial crime program and its testing requirement
- Conduct Risk — the behaviour-based risk that overlaps compliance
- Internal Audit in Financial Services — AML, compliance audits and regulatory matters in one guide
- The MRA and MRIA Lifecycle — what happens when the examiner writes the finding
- What Regulators Expect From Internal Audit — the seven tests examiners apply to the audit function
- Third-Party Risk Management Program — the channel that carries compliance obligations outside the organisation
- Key Risk Indicator Program — turning the metrics above into monitored indicators
- Compliance Risk category — every guide on the subject in one archive
Leave a Reply