Introduction
Compliance exposure rarely announces itself. A new SaaS vendor, a cloud migration, an acquisition, or a rule change can open a gap overnight. More often the gap sits between what the policy says and what people actually do.
Regulators notice that gap. In March 2025, HHS reached a $227,816 settlement with Health Fitness Corporation after finding no accurate, thorough risk analysis until January 2024.
This guide separates assessment from management, walks through five assessment steps, and shows how to turn findings into remediation, evidence, and ongoing oversight.
Key Takeaways
- An assessment maps obligations, risk scenarios, controls, evidence, and residual exposure.
- The five steps run from scoping through remediation and reassessment.
- A risk register with named owners turns findings into accountable action.
- Frameworks and tools support professional judgment; they don't replace it.
What Is a Compliance Risk Assessment and Why Does It Matter?
A compliance risk assessment is a structured review of the laws, regulations, contracts, industry standards, and internal policies that apply to an organization, along with the processes and controls meant to satisfy them. The COSO and SCCE guidance defines compliance risk as the possibility of violating those requirements, with financial or other negative effects.
Assessment vs. Management
The two are related but different:
- Assessment diagnoses exposure at a point in time.
- Management establishes, operates, monitors, and improves the controls that reduce it.
HIPAA draws the same line. 45 CFR 164.308 requires a risk analysis in one provision and risk reduction in a separate one. Doing the first doesn't satisfy the second.
A good assessment supports audit readiness, defensible budget decisions, fewer operational surprises, and clearer conversations with leadership about legal, financial, reputational, and cybersecurity risk. It doesn't guarantee compliance by itself.
What a Strong Assessment Should Answer
- Which obligations apply?
- Where could violations or control failures occur?
- How well do current controls work?
- What residual risk remains?
- Who owns each issue?
- What evidence supports each conclusion?
If your report can't answer all six, it's a draft.
How to Conduct a Compliance Risk Assessment in 5 Steps
Step 1: Define the Scope and Map Obligations
Set the objective, time frame, business units, systems, data, processes, jurisdictions, and third parties. Then list applicable federal and state requirements, contractual commitments, and relevant frameworks.
Applicability depends on your industry, data, customers, locations, services, and contracts. Don't assume. A few examples:
- HIPAA applies to covered entities and business associates.
- The GLBA Safeguards Rule covers financial institutions under FTC jurisdiction. Institutions holding information on fewer than 5,000 consumers are exempt from certain provisions, not the whole rule.
- PCI DSS applies where payment card data is handled.
Where interpretation is uncertain, get legal or compliance review before the scope is locked.
Step 2: Identify Risk Scenarios and Compliance Contact Points
Translate each obligation into a concrete scenario: "a terminated employee keeps access to patient records," or "a SaaS vendor stores regulated data without a signed agreement."
Look at data flows, access management, cloud and SaaS services, software development, financial processes, incident response, vendors, and operational technology where relevant.
Good sources for finding weak spots:
- Interviews and process walkthroughs
- Prior audit findings and incidents
- Complaints and policy exceptions
- Vulnerability data
- Third-party dependencies
Step 3: Evaluate Controls and Rate Residual Risk
Check whether each policy, procedure, technical safeguard, training, approval, and monitoring step is well designed and actually operating. NIST SP 800-53A makes the same distinction: correct implementation, intended operation, and desired outcome.
Separate two ratings:
- Inherent risk: exposure before any management action.
- Residual risk: what remains after controls.
Define likelihood and impact criteria up front, and record the evidence behind each rating. NIST SP 800-30 notes that likelihood scores often rest on experience and expert judgment, so avoid false precision. If you can't defend "4.7," use High, Medium, and Low.
Step 4: Prioritize Findings and Report the Current State
Rank findings by legal, financial, operational, safety, privacy, security, contractual, and reputational consequences. Weigh likelihood, control weakness, remediation effort, and deadlines.
Capture each one in a risk register. NIST IR 8286 Rev. 1 suggests fields such as ID, priority, description, category, likelihood, impact, exposure, response, owner, and status. In practice, include:
- Risk statement and affected obligation
- Business owner and control owner
- Rating and supporting evidence
- Remediation action, target date, and status
- Residual-risk decision
Step 5: Remediate, Monitor, and Reassess
Turn each priority finding into an action plan with an owner, milestones, required evidence, validation method, and escalation path. NIST lists four responses: accept, transfer, mitigate, or avoid. Record which one you chose and who approved it.
Reassess on a set cadence. HHS guidance sets no universal interval, so frequency depends on your circumstances. Also reassess after trigger events:
- A major incident or failed audit
- A regulatory change
- An acquisition or new product
- A material technology or vendor change
How to Turn Assessment Findings Into Risk Management Action
Build a Risk-Based Remediation Plan
Separate urgent control failures from lower-priority improvements. Sequence the work around business impact, how long each fix takes, and deadlines such as an audit date. Write down why limited resources go to particular risks first. That record is what makes your decisions defensible later.
Strengthen the Control Environment
Findings often call for updated policies, access reviews, segregation of duties, secure configuration, vendor requirements, retention practices, incident procedures, or role-based training. Tie every control to the specific risk it addresses. A control with no linked risk is hard to justify and easy to neglect.
Establish Accountability and Escalation
- Executive sponsors fund and unblock work.
- Compliance and legal interpret obligations.
- IT and security leaders implement technical controls.
- Control owners operate and evidence them.
- Internal audit tests independently.
- The board oversees material exposure.
Define escalation triggers: remediation overdue, a fix that didn't work, or a dependency on another department or vendor.
Create Evidence That Demonstrates Operation
A policy is a statement. Evidence proves it runs. Collect approvals, logs, training records, access reviews, test results, meeting minutes, tickets, vendor reviews, and documented corrective actions.
The Health Fitness settlement shows the stakes. Its two-year corrective plan requires an annual risk analysis review, a risk management plan, evaluation of changes, and written policies and procedures.
Measure Effectiveness and Communicate Residual Risk
Useful indicators include overdue remediation, repeat findings, control-test results, exception aging, incident trends, training completion, and third-party review status. NIST SP 800-55 distinguishes implementation, effectiveness, efficiency, and impact measures. Its examples are not industry benchmarks, so set targets from your own risk goals rather than borrowing numbers.
Board reporting should cover material exposures, changes since the last review, remediation progress, accepted risks, and decisions needing leadership support.
Frameworks, Tools, and Documentation for Compliance Risk Management
Choose Frameworks Based on Obligations and Business Context
These instruments serve different purposes and aren't interchangeable:
| Instrument | What it is |
|---|---|
| NIST CSF 2.0 | Outcome framework; doesn't prescribe how to achieve outcomes |
| NIST SP 800-53 | Catalog of security and privacy controls |
| ISO/IEC 27001 | ISMS requirements standard that supports certification |
| SOC 2 | Attestation criteria, not a certification |
| HIPAA, GLBA | Regulations with defined applicability |
| PCI DSS v4.0.1 | Payment-card security standard |
Contractual security requirements add a further layer. Map them alongside the rest.
Select Tools That Improve Visibility Rather Than Replace Judgment
Look for tools that support:
- Obligation-to-control mapping and risk scoring
- Workflow assignments and evidence collection
- Policy versioning, audit trails, and exception tracking
- Notifications, dashboards, and integrations with security and business systems
Spreadsheets can work for a small program. ISACA's commentary points to consistency, version-control, ownership, and manual-update problems as obligations, systems, and evidence volumes grow. That's the signal to move on.
Define the Contents of a Compliance Risk Report
A practical structure, adapted from NIST SP 800-30 Appendix K:
- Executive summary
- Scope and methodology
- Obligations reviewed
- Risk-rating criteria
- Key findings and control evidence
- Risk register extract
- Remediation plan and accepted risks
- Limitations, approvals, and review date
Common Challenges in Compliance Risk Assessment and Management
Scope creep and regulatory complexity. Set explicit boundaries, keep an obligations inventory, record assumptions, and schedule separate reviews for specialized requirements.
Data silos and thin expertise. Inconsistent terminology, incomplete asset inventories, and limited internal expertise distort ratings. Use cross-functional interviews, named evidence owners, standard definitions, and specialist help where needed.
Checklist thinking. A point-in-time exercise or a tool-generated score isn't enough. Validate how controls work in practice, monitor continuously, oversee third parties, and reassess after material change.
The DOJ's Criminal Division guidance asks three things of a program: is it well designed, is it adequately resourced and empowered, and does it work in practice. Prosecutors also ask how often risk assessments have been updated.
How to Build a Repeatable Compliance Risk Management Program
Establish Governance and a Review Cadence
Define clear ownership across the program:
- Risk appetite and approval authorities
- Decision rights and reporting lines
- Assessment owners and control owners
NIST IR 8286 Rev. 1 calls for senior leadership to set appetite, and COSO/SCCE notes that eliminating all compliance risk is unrealistic. Schedule routine reviews plus event-driven reassessments.
Connect Compliance Risk to Enterprise and Cybersecurity Risk
Compliance findings shouldn't sit in a separate repository. Link them to:
- Enterprise risk management and strategic planning
- Privacy, information security, and business continuity
- Third-party risk, incident response, and procurement
Use Specialist Support When Internal Capacity Is Limited
Outside help makes sense when you need:
- Formal risk assessments or framework alignment
- Audit readiness or remediation planning
- Interim security leadership
DeepSeas is one option for practitioner-led GRC support. Its specialists include ISO Lead Auditor-certified personnel, and its GRC services cover program design, gap assessments, risk registers, and ongoing delivery as platform, advisory, or fully managed offerings.
No provider can guarantee compliance, certification, or audit outcomes. Good support strengthens your evidence and decisions.
Improve the Program Through Recurring Feedback
Feed these inputs back into policies, controls, training, ratings, and the next scope:
- Assessment results and audit observations
- Incidents, near misses, and control tests
- Regulatory updates, vendor changes, and business expansion
Frequently Asked Questions
What are the 5 basic steps to risk assessment?
Define scope and obligations, identify risk scenarios, evaluate controls and score residual risk, prioritize findings and remediate, then monitor and reassess on a set cadence and after major changes.
What is a compliance risk assessment and what is its purpose?
A compliance risk assessment is a structured review of applicable obligations and controls. It identifies gaps, prioritizes exposure, and supports defensible remediation decisions.
Can you give me an example of a compliance report?
A typical report includes scope, methodology, obligations, risk ratings, evidence, findings, owners, remediation dates, residual-risk decisions, and approvals.
What are the best compliance tools?
It depends on your frameworks, scale, evidence volume, and integrations. Essential capabilities include control mapping, evidence tracking, risk registers, reporting, and audit trails.
What are the four types of risks?
Taxonomies vary. Commonly used categories are strategic, operational, financial, and compliance or legal risk. Cybersecurity, privacy, third-party, and reputational risks cut across them.
What are the 7 elements of compliance?
HHS-OIG's 2023 guidance lists seven elements: written policies and procedures; compliance leadership and oversight; training and education; lines of communication and disclosure; enforcing standards; risk assessment, auditing, and monitoring; and corrective action. The guidance is voluntary; requirements vary by context.
