A compliance risk assessment (CRA) is the structured evaluation of an organization’s exposure to failing to meet its legal and regulatory obligations: which obligations apply, how much harm a failure would cause, how likely a failure is given the way the business operates, how well the controls in place reduce that likelihood, and therefore where compliance monitoring, testing, training and investment should go. It is the document that the Department of Justice’s guidance on evaluating corporate compliance programs treats as the foundation of an effective program, that bank examiners expect under a compliance management system, and that an audit committee needs in order to know whether “we are compliant” means anything. Most organizations produce one as a list of laws with colors next to them, scored by whoever filled in the spreadsheet; the method below produces one that can be defended to a regulator and used to run a program.
This guide gives the method end to end. It covers the inputs (the obligations inventory and how to build it from regulatory sources rather than memory), inherent-risk scoring and the six factors that drive it with anchored scales, the control-environment overlay that turns inherent into residual, prioritization and the artifacts the assessment produces (the heat map, the monitoring and testing plan and the training plan), the governance and refresh triggers that keep it current, how internal audit tests the assessment and uses it in its own planning, a worked scoring example for a UK food manufacturer with ten obligations, how the method changes for a bank, and a template for a single obligation’s record. It is the method behind the compliance risk guide and the compliance versus compliance risk explainer, and the assessment that the conduct risk guide’s indicators sit alongside.
In this guide
- What the assessment is for, and who asks for it
- Step 1: the obligations inventory
- Step 2: inherent risk scoring
- Step 3: the control-environment overlay
- Step 4: residual risk and prioritization
- Step 5: the output artifacts
- Effort, tooling and the first cycle
- Governance and refresh triggers
- How the method changes for a bank
- How internal audit tests and uses the assessment
- Failures that make assessments decorative
- Worked example: Pennine Foods plc scores ten obligations
- Template: one obligation’s assessment record
- Questions about compliance risk assessments
- Related guides
What the assessment is for, and who asks for it
| Reader | What they want from it | Source of the expectation |
|---|---|---|
| Board and audit or compliance committee | Where the organization’s largest compliance exposures are, whether they are controlled, and where the compliance budget goes | Oversight duty; the committee charter‘s compliance clause |
| Prosecutors and enforcement agencies | Evidence that the program is risk-based and tailored, which is the first question in the Department of Justice’s Evaluation of Corporate Compliance Programs guidance (most recently updated in 2024) when deciding charging and penalties | DOJ guidance; the US Sentencing Guidelines’ effective compliance program criteria |
| Bank and financial regulators | A compliance management system built on a risk assessment that drives monitoring, testing and training, examined under the agencies’ compliance management system guidance | CFPB and prudential regulators’ examination manuals; the FFIEC BSA/AML manual for financial crime |
| Sector regulators (food, health, environment, data protection) | Evidence that the organization identified its obligations and addressed the serious ones | Sector rules; data protection authorities’ accountability principle |
| Internal audit | A reliable map of compliance risk to plan against and to test | Standard 9.1; the annual risk assessment |
| The compliance function itself | The basis for its monitoring plan, its resourcing case and its advice to the business | Its own mandate |
Step 1: the obligations inventory
The inventory (also called the regulatory universe or obligations register) is the list of legal and regulatory requirements that apply to the organization, at a level of granularity that can be assessed and owned. It is built from sources, not from memory: the jurisdictions the organization operates in; the licenses, permits and registrations it holds; the regulators it reports to; the laws that apply to any business of its size (employment, tax, health and safety, data protection, anti-bribery, competition, sanctions, modern slavery, environmental); the laws that apply to its sector (food safety, financial services, healthcare, telecoms); its contractual obligations with compliance content (government contracts, customer codes of conduct); and the voluntary commitments it has made publicly. Legal counsel, regulatory change services and the compliance function’s own horizon scanning are the usual inputs, and the inventory is validated by counsel before any scoring begins, because an obligation that is missing cannot be scored and an obligation that does not apply wastes every hour spent on it. Granularity is the practical decision: “UK GDPR” is too coarse to assess; “lawful basis and transparency for customer data”, “data subject rights handling”, “international transfers”, “breach notification within 72 hours” and “processor contracts” are assessable units with different risk profiles and owners. A mid-size organization’s inventory typically runs to 80 to 250 obligation units, grouped under a dozen or so themes (food safety, data protection, employment, anti-corruption, environment, competition, tax, reporting) so that owners and committees can see the shape; a bank’s to several hundred or thousands, grouped by regulatory theme. Each unit records the source (statute, regulation, rule, guidance), the regulator, the business activities it touches, the owner and the date last reviewed.
Step 2: inherent risk scoring
Inherent compliance risk is the exposure before the organization’s specific controls are credited: how bad a failure would be and how likely one is given the nature of the business. Six factors capture it for most organizations; each is scored one to five against written anchors, with the two consequence factors (penalty severity and customer harm) combined into an impact score and the four likelihood drivers combined into a likelihood score, so that the result can sit on the organization’s risk matrix rather than on a scale of its own. Weights are stated and sum to 100; the table gives a common set.
| Factor | Dimension | Weight | Score 5 anchor | Score 1 anchor |
|---|---|---|---|---|
| Penalty severity | Impact | 30 | Criminal liability for the company or individuals; license revocation; fines above 1 percent of revenue; mandatory public disclosure | Warning letter or minor civil penalty below the cost of remediation |
| Customer, market or public harm | Impact | 20 | Physical harm, significant financial loss to many customers, or systemic effects | No external harm; purely administrative |
| Enforcement climate | Likelihood | 15 | Active enforcement in the sector in the last two years; the regulator has stated a priority; peers penalized | No enforcement history; dormant regime |
| Complexity and judgment | Likelihood | 15 | Requirements ambiguous, judgment-heavy, changing, spanning many functions | Clear, stable, mechanical requirement handled by one team |
| Volume and exposure | Likelihood | 10 | Obligation touched by many transactions, employees, locations or third parties daily | Rare, centralized activity |
| Rate of change | Likelihood | 10 | Rule changed or business changed in the last year; new products, markets, systems or acquisitions in scope | Stable for three years on both sides |
Two scoring disciplines. Score inherent risk with the controls genuinely set aside; owners rate their obligations low because the controls are good, and the overlay in the next step exists to credit controls once, with evidence. And score by evidence where it exists: the penalty anchors come from the statute and recent enforcement, the enforcement climate from published actions, the volume from data. An inherent score that cannot be traced to a source is an opinion, and a regulator reading the assessment will treat it as one.
Step 3: the control-environment overlay
| Element | Assessed how | Rating |
|---|---|---|
| Policies and procedures | Exist for the obligation, current, map to the requirement, communicated to the people who perform the activity | Strong / adequate / weak / absent |
| Ownership and accountability | A named owner with authority; obligations with no owner are rated absent | |
| Preventive controls in the process | System rules, approvals, segregation, checklists at the point of activity (the control types guide) | |
| Detective controls and monitoring | Compliance monitoring, quality assurance, exception reports, KRIs; frequency and coverage | |
| Training and competence | Role-based training delivered and tracked for the people performing the activity | |
| Independent testing history | Results of compliance testing and internal audit in the last two years; open findings | |
| Incident history | Breaches, near misses, complaints and regulatory correspondence on the obligation |
The overlay produces one control-effectiveness rating per obligation on a four-point scale, and the rating is evidenced rather than asserted: a “strong” rating cites the monitoring results and the audit outcome; an obligation with an open High finding cannot be rated above weak. The rule that turns inherent into residual is fixed and published, as the matrix guide recommends for all risk ratings: strong controls reduce the likelihood score by two points, adequate by one, weak by none, and absent adds one; impact is never reduced by controls, because a penalty’s severity does not depend on how well the organization usually complies. The operational risk framework audit uses the same inherent-control-residual discipline and the same objections to free-hand residual ratings.
Step 4: residual risk and prioritization
Residual risk places each obligation on the organization’s matrix, and the matrix’s bands prioritize: red obligations get the deepest monitoring, annual independent testing and executive attention; amber get periodic monitoring and testing on a cycle; green get owner attestation and testing on rotation. Prioritization also considers three things the matrix does not show. Clustering: ten amber obligations in one process (a customer onboarding flow touching data protection, financial promotions, affordability and vulnerability rules) may deserve red-level attention as a cluster. Velocity: obligations with short regulatory deadlines (breach notification, transaction reporting) need monitoring that can detect a failure in time to meet the deadline, whatever their band. And tolerance: the organization’s compliance risk appetite, which the appetite guide argues should distinguish deliberate breaches (none accepted) from inadvertent ones (a tolerance with a defined response), decides which residual ratings are acceptable at all. The output is a ranked list with a rationale for every obligation in the top band, which is what the committee and the regulator read; the rationale states the facts behind the scores, not the scores alone, so that a reader can disagree with the judgment rather than with a number.
Step 5: the output artifacts
| Artifact | Content | Reader | Refresh |
|---|---|---|---|
| Heat map and ranked list | Every obligation’s residual position; top-band rationales; movement since last assessment | Board committee; regulator on request | Annual; on trigger |
| Monitoring and testing plan | For each obligation, the monitoring (first-line checks, second-line surveillance, KRIs) and the independent testing (compliance testing, internal audit) with frequency and owner, proportionate to residual band | Compliance function; internal audit for coordination | Annual, derived from the heat map |
| Training plan | Role-based training mapped to obligations and residual risk | Compliance and HR | Annual |
| Control gap register | Obligations rated weak or absent on controls, with remediation owners and dates | Management; the audit committee for the red items | Monthly tracking |
| Regulatory change log | Changes in the period, their effect on inherent scores, actions taken | Compliance committee | Continuous |
| Resourcing case | The compliance function’s budget and headcount request tied to the top-band obligations | Executive and board | Annual |
Effort, tooling and the first cycle
A first assessment for an organization of a few hundred obligation units is a one-quarter project: four to six weeks to build and validate the inventory with counsel, two to three weeks of scoring workshops with obligation owners (eight to twelve units per 90-minute session, scored live against the anchors so that the owner sees the method applied), two weeks for the control overlay with evidence gathered from monitoring, testing and incident records, and two weeks to produce the artifacts and take them through the committee. The compliance function’s effort runs to two or three person-months; owners give two to four hours each. A spreadsheet carries the first cycle; a GRC platform earns its cost once the inventory passes a few hundred units or the organization needs regulatory change feeds linked to obligations, and the GRC framework guide covers that choice. Subsequent cycles take a third of the first, because the inventory is reconciled rather than built and only the units touched by change are rescored in full; the rest are confirmed by their owners with the trigger log as evidence that nothing relevant moved. The order matters as much as in a business impact analysis: inventory before scoring, inherent before controls, residual before the plan, and the plan derived from the map rather than written beside it.
Governance and refresh triggers
The assessment is owned by the chief compliance officer (or the general counsel where no compliance function exists), with obligation owners accountable for their inherent and control inputs, approved by the compliance or risk committee and presented to the board committee annually. It is versioned, so that a regulator can see what the organization believed at a point in time, and it is refreshed on triggers as well as annually: a regulatory change in scope, an enforcement action against a peer, a new product, market, system or acquisition, a breach or near miss, an audit finding on a compliance control, or a change in the organization’s appetite. The weights and anchors are the methodology and change only by committee decision with the change logged, because an assessment whose scales move is one whose history cannot be read; the taxonomy guide’s governance rules transfer directly.
How the method changes for a bank
Banks run the same method at larger scale and with examiner-shaped expectations. The inventory is organized by regulatory theme (consumer protection rules by regulation, prudential requirements, financial crime, privacy, securities where applicable) and runs to hundreds of units; the consumer compliance assessment and the BSA/AML risk assessment are usually separate documents with their own methodologies, because the BSA assessment follows the FFIEC manual’s structure (products, services, customers, geographies) and feeds the independent test; the inherent factors add the product and customer dimensions examiners expect (complexity of products, customer vulnerability, channel); and the output drives the compliance testing schedule that examiners read beside internal audit’s plan. Examiners test the assessment much as internal audit does, below, and a stale or ownerless assessment is a finding on the compliance management system itself. The banking guide places the compliance management system among the second-line entities internal audit assures; the AML and compliance audits guide covers the engagements.
How internal audit tests and uses the assessment
| Test | Procedure | Finding pattern |
|---|---|---|
| Inventory completeness | Compare the inventory with licenses held, regulators reported to, jurisdictions operated in, counsel’s view and peer enforcement; test the granularity of five themes | Obligations missing (a new jurisdiction, a contractual code); themes too coarse to own |
| Inherent scoring evidence | For ten obligations, trace each factor score to its source (statute penalties, enforcement actions, volume data) | Scores without sources; controls credited in the inherent score |
| Control overlay evidence | For ten obligations, compare the control rating with monitoring results, audit findings and incident history | Strong ratings over open findings |
| Residual rule | Confirm the inherent-to-residual rule was applied, not overridden by hand | Residual ratings chosen rather than computed |
| Prioritization to plan | Trace the top band to the monitoring and testing plan and the training plan; confirm red obligations are tested | Monitoring plan unrelated to the heat map |
| Back-test | Map the period’s breaches, complaints and regulatory correspondence to the assessment’s ratings | Breaches in green obligations; the assessment did not predict |
| Refresh | Check triggers fired for the period’s regulatory changes, new products and incidents | Assessment older than the business |
| Governance | Approval records; versioning; methodology change log | Unapproved; weights changed silently |
Internal audit also uses the assessment: red and amber obligations enter the audit risk assessment‘s regulatory factor, the monitoring and testing plan is the input to coordination so that compliance testing and internal audit do not test the same control twice, and the control gap register is a source of engagements. The function keeps its own view: the internal audit versus compliance guide explains why relying on the second line’s assessment without testing it is not assurance.
Failures that make assessments decorative
| Failure | How it shows | Fix |
|---|---|---|
| Inventory from memory | The list is whatever the compliance team thought of; a new jurisdiction’s rules absent | Source-based build; counsel review; annual reconciliation to licenses and regulators |
| Laws, not obligations | “GDPR: Medium” | Assessable units with owners |
| Controls credited twice | Inherent scores low because controls are good; residual lower again | Inherent with controls set aside; one evidenced overlay |
| Residual by hand | Every obligation Medium or Low | Published inherent-to-residual rule; impact never reduced |
| No link to the plan | Monitoring plan written separately; red obligations untested | Plan derived from the heat map, with the derivation shown |
| Stale | Assessment dated before the last two regulatory changes | Triggers plus the annual cycle |
| Scales that drift | Weights changed to make the map look better | Methodology under change control |
| Written for the regulator | Everything controlled; no gaps admitted | Gap register published with the map; regulators reward candor |
Worked example: Pennine Foods plc scores ten obligations
Pennine Foods plc is a £900 million UK-listed food manufacturer used in examples across this site, with plants in England and a growing export business. Its general counsel owns compliance with a team of four, and the audit committee asked for a compliance risk assessment after the UK Corporate Governance Code work on Provision 29 made the board conscious that its risk management and internal control statement would cover compliance. The inventory, built from sources with external counsel’s review, ran to 140 obligation units; the table shows ten of them scored with the method above, using the weights in the inherent table. Inherent impact is the weighted average of the two impact factors and inherent likelihood the weighted average of the four likelihood factors, each rounded to the matrix’s five-point scale; the residual rule reduces likelihood by two for strong controls, one for adequate, none for weak, and adds one for absent.
| Obligation unit | Inherent impact | Inherent likelihood | Control rating and basis | Residual (impact × likelihood band) | Priority action |
|---|---|---|---|---|---|
| Food safety: hazard analysis and critical control points at each plant (Food Safety Act 1990 and retained EU hygiene regulations) | 5 (criminal liability; consumer harm) | 4 (volume; enforcement active) | Strong: certified management system, daily monitoring, unannounced customer audits passed | 5 × 2: amber | Maintain; internal audit tests annually given impact |
| Allergen labeling and precautionary statements | 5 (consumer harm; prosecutions in the sector) | 4 (recipe changes; complexity) | Adequate: label verification control, but two near misses in the year | 5 × 3: red | Strengthen label change control; compliance testing quarterly |
| Bribery Act 2010: adequate procedures for export agents and distributors | 5 (criminal; unlimited fines) | 3 (new export markets; third-party agents) | Weak: policy exists; no due diligence on agents in two new markets | 5 × 3: red | Agent due diligence program; training for export sales |
| UK GDPR: employee and consumer data (lawful basis, rights, breach notification) | 4 (fines up to 4 percent of turnover; reputational) | 3 (consumer promotions database; new HR system) | Adequate: data protection officer, records of processing; breach procedure untested | 4 × 2: amber | Test the breach procedure; monitor promotions consents |
| Health and Safety at Work Act: plant machinery and manual handling | 5 (fatality risk; corporate manslaughter exposure) | 3 (600 plant staff; machinery) | Strong: safety system, monitoring, declining incident rate | 5 × 1: amber | Maintain; board safety reporting |
| Modern Slavery Act 2015: statement and supply chain diligence | 3 (reputational; limited penalties) | 3 (seasonal labor; overseas ingredients) | Adequate: statement published; audits of labor providers annual | 3 × 2: green | Rotation testing |
| Competition Act 1998: pricing and information exchange with retailers and peers | 5 (fines up to 10 percent of turnover; director disqualification) | 2 (trade association contact; category management) | Adequate: policy and training; no monitoring of trade association attendance | 5 × 1: amber | Attendance protocol; refresher training for commercial team |
| Environmental permits: effluent and emissions at plants | 4 (prosecution; plant closure) | 3 (aging treatment plant at one site) | Adequate: monitoring in place; one exceedance in the year | 4 × 2: amber | Capital case for the treatment plant tracked |
| Employment law: working time and agency worker rules | 3 (tribunal awards; reputational) | 4 (seasonal agency labor; complexity) | Strong: HR controls; audited labor providers | 3 × 2: green | Rotation testing |
| Companies Act and Listing Rules: periodic reporting and inside information | 4 (regulatory action; market abuse exposure) | 2 (centralized; experienced team) | Strong: disclosure committee; insider lists; advisers | 4 × 1: green | Maintain |
Across the full inventory of 140 units, the assessment placed 9 obligations in red, 41 in amber and 90 in green. The two reds in the sample, allergen labeling and the Bribery Act procedures for new export markets, were the ones the general counsel had not expected: food safety and health and safety were where the attention had always gone, and the controls there were strong, while export growth had outrun the compliance program. The monitoring and testing plan was derived from the map (quarterly compliance testing of label change control; an agent due diligence program with internal audit testing in year one), the training plan added export sales and the commercial team, and the committee received the heat map with the nine red rationales and the gap register. Internal audit’s test of the assessment traced ten obligations’ scores to sources, found two inherent scores that had credited controls (corrected), confirmed the residual rule had been applied throughout, and reported to the committee that the assessment could be relied on for planning, which was the first time the committee had been told that about any compliance document.
Template: one obligation’s assessment record
Obligation unit: [Allergen labeling and precautionary allergen statements]. ID: [FS-04]. Source: [legislation and regulations, with citations; regulator guidance]. Regulator: [name]. Business activities touched:
. Owner: [technical director]. Inherent scoring (controls set aside): penalty severity [5: criminal liability; prosecutions in the sector, cite examples]; customer harm [5: allergic reactions, fatalities in the sector]; enforcement climate [4: active enforcement, cite]; complexity [4: recipe and supplier changes, precautionary statement judgments]; volume [4: 310 SKUs, 40 recipe changes a year]; rate of change [3: new products quarterly]. Weighted inherent impact [5]; inherent likelihood [4]. Control environment: policies [current]; ownership [named]; preventive [label verification at artwork approval; supplier specification control]; detective [finished goods label checks; complaint monitoring]; training [role-based, 92 percent complete]; testing history [compliance test 2025: two exceptions; internal audit 2024: Satisfactory]; incidents [two near misses in the year, no recall]. Control rating [adequate, because of the near misses]. Residual: likelihood reduced by one to [3]; impact unchanged at [5]; band [red]. Rationale for the band: [one paragraph]. Actions: [label change control redesign, owner, date; quarterly compliance testing; internal audit test year one]. Monitoring: [KRI: recipe changes without completed label verification; complaints mentioning allergens]. Assessed by / approved by / date / version: [fields]. Refresh triggers logged: [regulatory change; new product category; incident].
Questions about compliance risk assessments
What is a compliance risk assessment?
A structured evaluation of the organization’s obligations, the harm a failure to meet each would cause, the likelihood of failure given the business, the controls that reduce it, and therefore where monitoring, testing and training should go. It is the foundation of a risk-based compliance program.
How is inherent compliance risk scored?
On impact factors (penalty severity, customer and public harm) and likelihood factors (enforcement climate, complexity, volume, rate of change), each against written anchors with stated weights, with the organization’s controls deliberately set aside so that they are credited once, in the control overlay.
What is the difference between a compliance risk assessment and a regulatory inventory?
The inventory is the list of obligations that apply; the assessment scores them for inherent risk, overlays controls and prioritizes the residual. The inventory is the assessment’s first step and the one most often built from memory rather than sources.
How often should the assessment be refreshed?
Annually in full, and on triggers: a regulatory change in scope, an enforcement action against a peer, a new product, market, system or acquisition, a breach or near miss, or an audit finding on a compliance control.
Who owns the compliance risk assessment?
The chief compliance officer or general counsel owns the method and the document; obligation owners provide and stand behind their inputs; the compliance or risk committee approves it; the board committee receives it annually. Internal audit tests it and uses it, but does not own it.
What do regulators look for in a compliance risk assessment?
That it is complete, tailored, evidenced and used: an inventory built from sources, scores traceable to penalties and enforcement, controls credited on evidence, a monitoring and testing plan derived from the results, and a refresh history that tracks the business and the rules.
How does internal audit use the assessment?
After testing it, as an input to the audit risk assessment’s regulatory factor, as the basis for coordinating with compliance testing so controls are not tested twice, and as a source of engagements from the control gap register.
Related guides
- Compliance risk: a comprehensive guide — the risk the assessment maps.
- Compliance vs compliance risk — the distinction in brief.
- Conduct risk — the behavioral cousin, with its indicators.
- Internal audit vs compliance — why the function tests rather than relies.
- AML, KYC and compliance audits — the engagements that follow.
- How to audit the BSA/AML program — the financial crime assessment’s independent test.
- Internal audit in banking — the compliance management system as a second-line entity.
- Risk assessment matrix — the scales and the residual rule.
- Risk taxonomy — governance of methodology and categories.
- Appetite, tolerance and capacity — the compliance appetite that decides acceptable residual.
- Preventive, detective and corrective controls — the control overlay’s vocabulary.
- How to audit operational risk management — the same inherent-control-residual discipline.
- The annual internal audit risk assessment — where the results enter audit planning.
- UK SOX and Provision 29 — the Pennine context.
- UK regulatory compliance after Brexit — the retained-law picture.
- Internal audit and the UK’s fight against fraud and corruption — the Bribery Act context.
- Data privacy audit — testing the GDPR obligations.
- The audit committee annual agenda — where the assessment is received.
- Auditing the Ethics and Compliance Program: Tests & Metrics — a program-effectiveness audit mapped to the DOJ and Sentencing Guidelines criteria.
Leave a Reply