How To Conduct Compliance Risk Analysis And Draw Insights

Organisations today face an ever-changing business environment. On one hand, authorities are continuously implementing and tweaking legislation and, on the other, millennial investors and other stakeholders are choosing value-driven over purely profit-led approaches. These are just a few of the risks businesses may have to mitigate. That’s why understanding your risk profile and knowing what action to take is of utmost importance. 

Compliance risk analysis gives you insight into how exposed to potential risks your company is and the likelihood of those risks becoming a reality.

There are a number of possible negative outcomes for companies that do not manage compliance risk effectively. They include: 

• Financial penalties
• Product seizures
• Restrictions on trading
• Loss of contracts and other business opportunities
• Imprisonment of management personnel
• Reputational damage
• Negative effect on the price of financial instruments relating to an issuer 

This article explains what a compliance risk analysis is and how a chief compliance officer can perform one in a manner that protects their organisation. 

1. What does compliance risk involve?

Compliance risk, also known as regulatory risk, relates to the likelihood of your company contravening any given piece of legislation. These risks stem from a number of potential factors, including:  

• Insufficient due diligence
• Inadequate internal compliance systems
• Failure to keep up with legislative change
• Inadequate training
• Human error
• Failures of corporate governance

Although the majority of compliance risk relates to laws and regulations, it can also include unethical behaviour that falls short of the expectations of investors and other stakeholders.  

2. What is a compliance risk analysis?

A compliance risk analysis involves identifying the areas in which your company could potentially overstep the legal and ethical boundaries, as well as the likelihood of doing so. These risks are usually divided into four broad categories: 

3. What is the purpose of a compliance risk analysis?

Once you have identified all of the relevant risks within your business, you can plan how to mitigate those risks. The analysis allows you to:  

• Assess the severity of each risk, including how likely it is to happen and the impact it would have if it happened.
• Understand which are the most pressing risks relating to your business.

• Control the risks. Once you have your risks placed in order of priority, you can devise a plan to try and prevent them from becoming a reality.  

The analysis and subsequent actions help not only to reduce the risk of these events occurring but also act as an audit trail to show regulators that you took measures to remain compliant. Even if the risk you identified occurs, being able to provide proof that you recognised it and attempted to prevent it could result in a more lenient outcome from any subsequent investigation.

4. Seven steps to conduct compliance risk analysis

4.1 Identify the relevant risks

To identify the relevant risks to your business, you need to collaborate with all different sections and departments. Modern businesses can span multiple fields and various regions, meaning that you need to consult with the stakeholders who deal with regulatory matters on a regular basis when creating compliance programs. This is particularly highlighted for businesses that work across the European Union and the UK. Before Brexit, the legislative framework was largely the same. Now that the United Kingdom has left the EU, the two compliance landscapes will continue to grow separately. 

Look at how your workflows run, the systems you have in place to flag issues and the training programmes used to keep employees up to date with the latest legislation. If you spot any compliance issues, you should note them down and add them to your risk management schedule.  

4.2 Map risks to possible outcomes

Once you have your list of risks, you should extrapolate them to understand how they could affect the business in reality. 

For example, imagine this situation in a financial services business. You don’t have an automated pre-clearance process for allowing or preventing personal trades by brokers or advisors. This could lead to conflicts of interest or insider dealing, which could result in a financial penalty. Credit Suisse was fined US$345,000 in 2021 for failing to have the necessary systems in place for tracking whether new hires correctly declared their personal trades.  

4.3 Prioritise the most severe risks

Compliance professionals should assess the risk levels of each potential issue in the business. It makes sense that you devote most of your time and resources to risks that are the most likely to happen and which would make a large impact if they did. Similarly, you can put the risks that are less common and which would be least impactful to the back of the queue.  

Whether it means implementing a new system or shoring up the existing system, it’s best to work from the highest priority downwards in terms of the level of risk. Think about what needs to be in place to alert you to violations of your processes or how you can improve the system that is in place right now. 

For example, you might have a telephone hotline as an internal reporting system for whistleblowers. However, there is a risk that you will breach the requirements in the EU Whistleblowing Directive for confidentiality and for data protection, as necessitated by GDPR. In this case, you could make your processes more robust using an automated whistleblowing tool like IntegrityLog.  

4.4 Track changes

Monitoring the legislative landscape is imperative for compliance. You need to understand what is changing and when in terms of laws that affect your organisation. This requires a system in place to make sure you do not miss relevant legislative changes.  

Some businesses use an automated service that imparts the information, and others delegate the task to local advisory firms. However you track the changes in legislation across the territories in which you operate, you should have an efficient system that pools the information in an easy-to-understand manner.  

4.5 Implement controls

Once you have mapped out the systems you need to maintain compliance and mitigate a particular risk, you should implement the appropriate controls as soon as possible so you can begin to benefit from them. Put the systems in place and ensure that all relevant staff are versed in how to use them and what to do if a compliance issue arises. 

4.6 Validate through testing

The only way to fully understand how robust your systems are is to test them thoroughly. Make sure that the compliance controls for each risk or set of risks are working as they should. You can conduct this testing in-house, but there are also Testing as a Service companies that can put your controls under great scrutiny to ensure that they are operating as they should.  

4.7 Re-evaluate risks as needed 

Your compliance controls are not set in stone because the business world keeps evolving and so does your organisation. This means you have to continuously be aware of changes in the risks that you face and adjustments to the legal frameworks under which you operate. 

5. Where are compliance risks typically high?

There are some common areas of high risk relating to compliance in the business world:  

5.1 Employee behaviour

From enacting retaliation on whistleblowers to committing insider dealing, non-compliant employee behaviour causes problems for the individual as well as the organisation. 

5.2 Environmental impact

With the growth of sustainable investment, companies are increasingly focused on their ESG performance. Not only does a company with negative environmental impact risk reputational damage, but it can also face stiff penalties for contravening relevant laws.  

5.3 Data protection

The General Data Protection Regulation (GDPR) in the EU requires companies to handle and use data in very specific ways. The legislation can be tricky to understand but it’s key to do so because non-compliance can be costly. The potential penalties are up to €20 million or 4 per cent of worldwide turnover for the preceding financial year, whichever is highest.

5.4 Money laundering

Sophisticated criminals are using evermore clever ways to launder money through legitimate financial institutions. This is why the EU is continuously updating its anti-money laundering legislation, and companies must ensure their customer due diligence efforts are as secure and robust as possible. 

6. FAQs

6.1 Which frameworks are associated with compliance risk assessments?

The Committee of Sponsoring Organizations (COSO) framework is one of the most highly valued frameworks for conducting risk analyses. It offers flexibility for businesses to customise their internal controls within the broader framework of efficiency and collaboration. 

6.2 How is a compliance risk assessment different from other risk assessments?

Compliance risk assessments differ from other assessments due to their centring around the risk of falling foul of regulatory issues. Strategic, operational and financial risk assessments all take into account compliance matters but specific compliance analyses require a laser focus on the legislation.  

6.3 Who is responsible for managing compliance risk?

A risk compliance manager or chief compliance officer is responsible for managing risk for the company and overseeing the process of the compliance risk assessment along with the compliance team. The compliance function formulates compliance programs and all aspects of regulatory compliance.

7. Conclusion

A compliance risk analysis is essential in protecting your company from potential financial penalties, prosecution, reputational damage and financial losses that arise when businesses deviate from the law. You discover the risks associated with your business, understand how they relate to your organisation and can then work out the steps you must take to minimise those risks. 

Using automated tools, created especially to maintain compliance with the latest legislation in your industry and territory, you can ease the burden for your compliance team and maintain peace of mind that you are doing all you can. Request a demo of one of ComplyLog’s automated compliance tools today. 

8. References and further reading

• GDPR and whistleblowing reports
• Personal trading compliance
• Compliance risks
• Types of business risk
• Insider Dealing