Risk assessment
Compliance Risk Assessment
A step-by-step approach to identifying where obligations could be breached and where controls deserve attention.
Why this matters
A step-by-step approach to identifying where obligations could be breached and where controls deserve attention.
Define the scope
A useful assessment starts with products, services, jurisdictions, customers, data, payments, workforce activities, vendors and licenses. Vague enterprise-wide scoring often hides the process where the risk actually occurs.
Describe risk events
Write risks as events: what could happen, through which process, and with what consequence. “Privacy risk” is too broad. “Customer data is retained beyond the approved period because deletion jobs are not monitored” is testable.
Consider inherent and residual risk
Inherent risk estimates exposure before controls. Residual risk estimates what remains after considering control design and operation. The distinction helps prioritize testing and remediation, but scores should not create false precision.
Use evidence
Input may include incidents, complaints, audit findings, regulatory correspondence, control-test results, transaction volumes, system changes, employee turnover and third-party dependencies.
Make decisions visible
Record whether the organization will avoid, reduce, transfer, monitor or accept the risk, who approved the decision, what action is required and when the assessment will be revisited.
Questions to document
- Which obligations and processes are in scope?
- Who owns the activity and who independently reviews it?
- What record demonstrates that the activity operated?
- What happens when the control fails or circumstances change?
Related planning tools
Use the local planning tools to turn the concepts into a structured working note.