A compliance risk assessment is a structured process for identifying where your organization is most likely to violate laws, regulations, or internal policies, and how severe the consequences would be if it did. You conduct one by assembling a cross-functional team, cataloging every regulatory obligation that applies to your operations, scoring each risk for likelihood and impact, and then concentrating resources on the risks that exceed the tolerance leadership has set. Getting this right matters because federal penalties can reach tens of thousands of dollars per violation, and the Department of Justice weighs whether a company had a meaningful compliance program when deciding how aggressively to pursue it.1Department of Justice. Evaluation of Corporate Compliance Programs
Who Should Run the Assessment
The single biggest predictor of whether the exercise produces useful results is who sits on the team. An assessment run entirely by the compliance department tends to reflect what compliance officers already know and miss the risks buried in operations they never see.
At minimum, pull in a compliance lead to manage the process, a representative from legal counsel, an information security lead, and operations managers from each major business unit. If your organization handles health data, financial reporting, or international transactions, someone with direct knowledge of those workflows needs a seat. The board or a senior executive should sponsor the effort so that department heads take interview and document requests seriously. A team without visible leadership backing gets stonewalled.
Designate one person to own the final risk inventory and keep it current between full assessments. Without a single point of accountability, the document goes stale within months.
Building the Risk Inventory
Before you can score anything, you need a complete picture of what your organization does and what rules govern that activity. Start with internal governing documents: employee handbooks, standard operating procedures, organizational charts, existing compliance policies, and training records. Gaps in documented training are one of the first things regulators look for during an investigation.
Then compile every federal and industry-specific mandate that touches your operations. A publicly traded company has to account for Sarbanes-Oxley requirements for internal controls over financial reporting, which require management to evaluate those controls annually and have the company’s auditor attest to that evaluation.2U.S. Securities and Exchange Commission. Sarbanes-Oxley Disclosure Requirements Organizations handling medical data need to address HIPAA. Companies whose international operations involve foreign government officials must account for the Foreign Corrupt Practices Act. If you process data from European residents, GDPR obligations belong on the list regardless of where you are headquartered.
Collect any external audit reports, prior enforcement actions, and previous assessment results. These show where regulators have already found problems and where your organization has historically been weakest. DOJ guidance on evaluating corporate compliance programs specifically examines whether a company’s risk assessment reflects lessons from its own misconduct history.1Department of Justice. Evaluation of Corporate Compliance Programs
All of this feeds into a centralized inventory, usually a detailed spreadsheet or database that maps each policy or control to the specific legal requirement it addresses. Every entry should include the policy name, the regulation it satisfies, the date it was last updated, and the person responsible. This inventory is the backbone of everything that follows.
Setting Risk Appetite Before You Score
Leadership needs to articulate how much risk the organization is willing to accept before scoring begins. Without that, the numbers have no context. A risk score of 12 out of 25 means nothing if no one has decided what threshold triggers action.
Risk appetite statements are usually qualitative. A financial services firm might declare zero tolerance for anti-money-laundering violations while accepting moderate risk in vendor contract disputes. A manufacturer might set a low threshold for workplace safety infractions but tolerate more exposure to contract litigation. These statements come from senior leadership and the board, not from the compliance team working alone.
Translate the qualitative statements into numerical thresholds. On a 25-point scale, your organization might define 1 through 5 as acceptable, 6 through 10 as requiring monitoring, 11 through 17 as needing active mitigation, and 18 through 25 as demanding immediate action. Certain categories, such as bribery or data breaches involving protected health information, may warrant zero-tolerance treatment where any identified exposure triggers remediation regardless of the numerical score.
Categories of Risk to Cover
Organizing risks into categories helps ensure you don’t overlook whole areas of exposure. Four categories cover most of what organizations face.
Regulatory Risk
Regulatory risk is the chance that a government agency intervenes because your organization failed to follow a law or rule. OSHA can impose penalties up to $16,550 per serious violation and $165,514 for willful or repeated violations, with daily penalties for failing to correct known hazards.3Occupational Safety and Health Administration. OSHA Penalties Under the Foreign Corrupt Practices Act, a corporation convicted of bribing a foreign official faces criminal fines up to $2,000,000 per violation, and individual employees risk up to five years in prison and a $100,000 fine.4GovInfo. 15 USC 78ff – Penalties Agencies can also pursue alternative fines of up to twice the gain or loss from the violation, which often dwarfs the statutory cap.
Legal Risk
Legal risk covers private lawsuits rather than government enforcement. Employment discrimination claims under Title VII, wage-and-hour class actions, and shareholder derivative suits all fall here. These cases can produce settlements or verdicts well beyond what regulators would impose, and defense costs mount even when the company ultimately wins.
Data Privacy and Security Risk
Exposure in this category has grown sharply. For 2026, a single HIPAA violation can draw fines ranging from $145 to $73,011 depending on culpability, with an annual cap of $2,190,294 for repeated identical violations.5Federal Register. Annual Civil Monetary Penalties Inflation Adjustment Willful neglect that goes uncorrected carries a minimum penalty of $73,011 per violation with no upper limit below the annual cap.6eCFR. 45 CFR Part 160 Subpart D – Imposition of Civil Money Penalties The FTC can also pursue penalties up to $53,088 per violation of its rules against unfair or deceptive practices, which frequently covers mishandling consumer data.7Federal Register. Adjustments to Civil Penalty Amounts
Emerging Technology Risk
DOJ updated its corporate compliance guidance in September 2024 to specifically ask whether companies have a process for managing risks from new technologies, including artificial intelligence. Prosecutors now examine whether AI risk management is integrated into broader enterprise risk strategies and whether controls monitor AI systems for trustworthiness and legal compliance. The NIST AI Risk Management Framework provides a voluntary structure built around four functions: govern, map, measure, and manage.8National Institute of Standards and Technology. AI Risk Management Framework Adopting a recognized framework is not required, but it strengthens your position if regulators later question whether your organization took AI-related compliance seriously.
Scoring Likelihood and Impact
With inventory and categories in place, scoring begins. The standard approach uses a five-point scale for two dimensions: likelihood (how probable is the risk event within the next 12 months) and impact (how severe the consequences would be if it occurred). Multiplying the two produces a raw score between 1 and 25 for each risk.
Likelihood scores should reflect actual data wherever possible. If your organization has been cited for a particular violation before, that risk gets a higher likelihood score than something only theoretical. Impact should account for financial penalties, litigation exposure, reputational harm, and operational disruption. A risk that could shut down a production line scores differently from one that might produce a modest fine.
The raw score is your inherent risk, the exposure before existing safeguards are considered. Next, evaluate the controls already in place: automated monitoring, dual-authorization requirements, training programs, internal audits. The adjusted number is your residual risk, the exposure remaining after current protections.
Plot the residual scores on a color-coded heat map. Scores of 1 through 5 typically need only routine monitoring. Scores from 6 through 10 are moderate and warrant closer tracking. Anything above 10 is high-priority, and scores above 17 should be flagged for immediate remediation. Compare these results against the appetite thresholds leadership set earlier. Any residual risk that exceeds the organization’s stated tolerance needs a corrective action plan.
One thing separates a useful assessment from a box-checking exercise: scoring sessions should involve department heads and frontline managers, not just the compliance team working from documents. The people who run a process daily know where the gaps are. A well-designed interview with an operations manager will surface risks that no amount of policy review would reveal.
Vendor and Third-Party Risk
Your compliance exposure doesn’t stop at your walls. Every vendor, contractor, and service provider that handles your data, interacts with your customers, or performs regulated activities on your behalf extends your risk profile. Regulators typically hold you responsible for vendor failures involving your data or your customers.
Classify vendors by the access they have to sensitive data and regulated processes. A cloud hosting provider with access to customer health records carries fundamentally different risk than an office supply vendor. High-risk vendors should receive detailed questionnaires covering data protection practices, access controls, incident response procedures, and their own third-party management.
For critical vendors, request a SOC 2 Type II report. A Type I report only confirms controls were properly designed at a point in time, while a Type II report covers an audit period of six to twelve months and shows the controls actually worked.9AICPA & CIMA. SOC 2 – SOC for Service Organizations Trust Services Criteria The report covers security, availability, processing integrity, confidentiality, and privacy.
Vendor contracts should include specific, actionable security obligations rather than vague references to “reasonable measures.” Build in audit rights, breach notification timelines, and requirements to maintain alignment with specific frameworks like NIST SP 800-161 for supply chain risk management.10NIST Computer Security Resource Center. Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations Require vendors to notify you of incidents within a defined timeframe, and name the point of contact. Vendor risk should be scored and tracked in the same inventory as internal risk.
Writing Corrective Action Plans
Identifying risks is only useful if you fix the ones that matter. Every risk that exceeds your organization’s appetite needs a corrective action plan with specific steps, assigned owners, and deadlines. The most common failure is writing plans that amount to “we’ll try harder” rather than changing the process that created the problem.
Effective remediation starts with root cause analysis. The goal is to find the underlying system or process failure, not just the surface symptom. If employees are mishandling protected data, the root cause may not be carelessness. It might be that the data system doesn’t restrict access by default, or that onboarding training doesn’t cover data handling for the tools the team actually uses.
Corrective actions vary in strength, and weaker actions tend to produce weaker results. Policy changes, additional training, and warning labels depend entirely on human behavior and are the easiest to circumvent. Stronger actions change the environment itself: engineering controls that prevent unauthorized access, simplified processes that reduce error opportunities, and system redesigns that make the compliant path the easiest path.11Centers for Medicare & Medicaid Services. Guidance for Performing Root Cause Analysis with Performance Improvement Projects Push for structural fixes over behavioral ones wherever feasible.
Each plan should document the specific gap identified, the root cause, the corrective actions, the person responsible, the deadline, and the metrics that will confirm whether the fix worked. This documentation drives accountability internally and demonstrates good faith to regulators if the organization ever faces an enforcement action.
Reporting to Leadership and Protecting Privilege
The results need to reach the people who control budgets and priorities. The formal risk report should translate the heat map and scoring data into language that executive leadership and board members can act on, focused on the highest residual risks, the financial exposure each represents, and the resources the recommended actions will require.
Spell out the specific penalty ranges attached to your most significant risks. HIPAA violations due to willful neglect carry minimum penalties of $73,011 per violation in 2026.5Federal Register. Annual Civil Monetary Penalties Inflation Adjustment FCPA anti-bribery convictions can cost a corporation up to $2,000,000 per violation in criminal fines alone.4GovInfo. 15 USC 78ff – Penalties When the board can see concrete dollar figures next to residual scores, the conversation about funding compliance improvements becomes much more productive.
Protecting the Report Under Privilege
Your assessment report can be discoverable in litigation. If your organization is later sued or investigated, opposing counsel can potentially use the assessment to prove you knew about a risk and failed to address it. The way to mitigate this is to involve legal counsel in the process from the start.
To strengthen privilege, have in-house or outside counsel formally direct the assessment and document that its purpose is to provide legal advice. Mark all assessment materials as attorney-client privileged. Keep privileged communications directed to counsel rather than circulated among non-lawyer executives, and be cautious about sharing details with outside auditors or regulators, since prior disclosure to third parties can undermine privilege claims later. These steps don’t guarantee protection in every jurisdiction, but they significantly improve your position.
Keeping the Assessment Current
An assessment that sits in a drawer for a year is a liability, not an asset. Regulations change, operations evolve, and new risks emerge between full assessments. Most organizations run a comprehensive reassessment on a 12-month cycle, with quarterly reviews for high-risk areas.
Between full assessments, maintain a centralized risk register tracking every open corrective action, its current status, and its deadline. Assign someone to own this register and report on it regularly. When a corrective action is completed, verify that it actually reduced the residual score rather than simply checking a box.
Build regulatory change monitoring into the process. Designate someone to track new rules, enforcement trends, and agency guidance relevant to your industry. The updated DOJ guidance now specifically asks whether companies have a process for identifying emerging risks from new technologies.1Department of Justice. Evaluation of Corporate Compliance Programs An organization that can show it identified a new obligation and incorporated it into the inventory before an enforcement event is in a fundamentally different position than one that waited to be told.
Treat each monitoring cycle as a chance to validate your appetite thresholds. As the organization grows or enters new markets, the level of risk leadership considers acceptable will shift. The thresholds set during your first assessment may not reflect reality 18 months later. Revisiting them annually keeps the framework calibrated to where the business actually is.