Compliance Risk Assessment

A compliance risk assessment is the exercise of identifying where your company is most likely to break the law or its own rules, then ranking those risks so you can put resources against the biggest ones. It's the step that tells you which policies to write, which training to assign, and which third parties to look at twice. Both the Sentencing Guidelines and the DOJ expect it to happen periodically, and neither one says annually.

What does a compliance risk assessment cover?

Start with the obligations that actually bind your company, then work outward to the places where people could breach them. For most companies that means anti-bribery and corruption, conflicts of interest, gifts and hospitality, trade and sanctions exposure, data privacy, employment and harassment risk, health and safety, and whatever sector rules apply on top.

The assessment isn't a list of laws. It's a list of scenarios. "A distributor in a high-corruption market pays a customs agent to release a shipment" is a risk you can score, assign an owner, and design a control against. "The FCPA" isn't.

Three inputs do most of the work: what your business does and where, what your own data says (hotline reports, investigation outcomes, audit findings, expense exceptions), and what people tell you when you interview the business owners who live closest to the risk.

How do you score and rank compliance risk?

Most teams score each risk on likelihood and impact, then rate it before and after controls. That second step is the one people skip, and it's the one that shows whether your program is doing anything.

Impact should count more than money. A risk that produces a criminal referral, a debarment, or a front-page story ranks above one that produces a fine you could pay out of petty cash. Keep the scale short. A five-point scale that people apply consistently beats a hundred-point model nobody trusts.

How often should you run one?

The Sentencing Guidelines at 8B2.1(c) say that in implementing subsection (b), "the organization shall periodically assess the risk of criminal conduct and shall take appropriate steps to design, implement, or modify each requirement set forth in subsection (b) to reduce the risk of criminal conduct identified through this process." The DOJ's Evaluation of Corporate Compliance Programs asks whether "the periodic review [is] limited to a 'snapshot' in time or based upon continuous access to operational data and information across functions."

Most teams settle on annual out of habit. Some regimes set a floor. NYDFS cybersecurity regulation 23 NYCRR 500.9(a) says the risk assessment "shall be reviewed and updated as reasonably necessary, but at a minimum annually," and Advisers Act Rule 206(4)-7(b) requires an adviser to "[r]eview, no less frequently than annually, the adequacy of the policies and procedures established pursuant to this section and the effectiveness of their implementation," which is a related but different exercise that people routinely blur together. Check your sector before you set your calendar.

A practical middle path: a full refresh on a set cycle, plus a triggered update when something changes the risk picture. New market, new acquisition, new product line, new regulator interest, or a serious investigation all qualify.

How do you turn the assessment into a plan?

The assessment earns its keep at the handoff. Every high risk should come out the other side with an owner, a control, and a date.

That handoff is also where the seven elements of an effective compliance program get their marching orders. Risk assessment sits outside the seven, in subsection (c) of USSG 8B2.1, and it drives all of them: it tells you which standards to write into your code of conduct, who to train and how often, where to add monitoring, and which counterparties need a closer look before you transact. If your highest-rated risk is trade exposure, your program should show more sanctions screening coverage and a training assignment that reaches the people who touch shipments.

What do regulators look for?

The DOJ's Evaluation of Corporate Compliance Programs asks three things about risk assessment: "What methodology has the company used to identify, analyze, and address the particular risks it faces?"; "Does the company deploy its compliance resources in a risk-based manner, with greater scrutiny applied to greater areas of risk?"; and whether the periodic review is "limited to a 'snapshot' in time or based upon continuous access to operational data and information across functions."

That middle question is the one that catches companies. It puts what your assessment said was risky next to where your money, headcount, training, and monitoring actually went. A document that names bribery as your top risk while your training calendar is all harassment tells a story you don't want to tell. Section 8B2.1 is the Sentencing Commission's standard for an effective compliance and ethics program, and subsection (c) puts risk assessment at the center of it.

FAQ

Is a compliance risk assessment legally required?

It depends on who regulates you. USSG 8B2.1(c) says an organization "shall periodically assess the risk of criminal conduct" as part of an effective compliance and ethics program. Sector rules go further. NYDFS 23 NYCRR 500.9(a) requires a cybersecurity risk assessment reviewed and updated at a minimum annually.

Who should run the assessment?

Compliance owns the process, and the business owns the answers. The useful version pulls in legal, internal audit, finance, HR, IT, and the regional leaders who know what actually happens in their markets.

How is a risk assessment different from an audit?

A risk assessment looks forward and asks where something could go wrong. An audit looks backward and tests whether a control worked. The assessment tells you what to audit.