What is a compliance risk?
A compliance risk has three parts: a binding obligation, a plausible breach of it and the consequences of that breach. Recording only the breach, such as "data protection breach", describes a keyword, not a risk.
In Germany the risk becomes legally tangible through § 130(1) of the Act on Regulatory Offences (OWiG), which treats a failure to supervise business-related duties as an administrative offence. Compliance risks are identified and treated in a compliance management system, as described by the German auditing standard IDW PS 980 and by ISO 37301.
Who is liable for compliance risks?
In Germany both the company and its management are liable for compliance risks. Alongside fines come management's liability for damages and mandatory exclusion from public tenders:
| Provision | Who it applies to | Consequence |
|---|---|---|
| § 130(3) OWiG | owner of a business or company | fine of up to EUR 1 million where the breach that was not prevented carries a criminal penalty |
| § 30(2) OWiG | legal person or association | fine of up to EUR 10 million for an intentional, up to EUR 5 million for a negligent criminal offence by a person in a management role |
| § 43(2) GmbHG | managing directors of a limited company | joint and several liability to the company for the resulting damage |
| § 93(2) AktG | members of a stock corporation's executive board | damages as joint debtors; in a dispute they bear the burden of proving their due care |
| § 123(1) GWB | the company | mandatory exclusion from public procurement after a final fine under § 30 OWiG for one of the criminal offences listed there |
A failure to supervise also reaches the company. § 130(3) sentence 2 OWiG applies § 30(2) sentence 3 OWiG. The maximum company fine therefore rises tenfold, here to EUR 10 million.
Compliance management counts when the fine is set. The BGH, Germany's Federal Court of Justice, treated "efficient compliance management" as relevant to fines under § 30 OWiG (BGH, 9 May 2017, 1 StR 265/16). How this liability carries over to information security is covered in the post on management liability for IT security.
How does a compliance risk analysis work?
A compliance risk analysis can be run in eight repeatable steps whose results can be compared from one round to the next. Its basis is the legal register, the inventory of applicable obligations drawn from sector law, supervisory law, contracts and standards the organisation has chosen.
| Step | Output | Where the step fails |
|---|---|---|
| 1. Fix the scope | named entities, sites, processes and countries | The scope stays open, and nobody knows what the statement covers. |
| 2. Gather the obligations | a legal register built from the four sources | A generic topic list replaces your own obligations. |
| 3. Establish the facts | interviews and documents from the business areas | The compliance function assesses how things should be instead of finding out how they are. |
| 4. Assess inherent risk | the risk without credit for existing controls | Net is assessed straight away, and the effect of the controls drops out of sight. |
| 5. Map and test controls | named controls per risk that are actually performed | Described controls count as effective although nobody has seen them performed. |
| 6. Assess net risk and prioritise | a ranking that can carry a decision | A traffic light with no scale whose colours nobody can derive |
| 7. Treat, or accept with reasons | a measure with a date and an owner, or a documented acceptance | The risk stays "under observation", meaning undecided. |
| 8. Report and diarise | a report to management and the date of the next round | The analysis stays a one-off project. |
Two steps carry the sequence. Step 3 makes the analysis measure the company rather than the compliance function's picture of it. Separating inherent and net risk in steps 4 and 6 shows which controls work and which exist only on paper.
Which criteria are used to assess a compliance risk?
Assess five dimensions for each obligation in the register:
| Dimension | Guiding question |
|---|---|
| Likelihood | How likely is a breach given today's processes and controls? |
| Impact | What sanctions, liability and business interruption would follow? |
| Likelihood of detection | Would a breach surface internally, or only through a supervisor, a customer or a whistleblower? |
| Effect on others | Who would be affected: staff, customers, data subjects, the wider public? |
| Reputational effect | How would a breach that became public land with customers, supervisors and staff? |
Every assessment needs a named risk owner, because without one there is nobody to take the treatment decision.
Ten subject areas as a cross-check
Compliance risks are specific to each company, but ten subject areas work as a cross-check on whether a field has been overlooked:
- bribery and improper advantage
- competition and antitrust law
- anti-money laundering
- sanctions and export control
- data protection
- information security and reporting duties
- employment and occupational safety law
- tax and customs
- product and environmental law
- supply chain due diligence
The list does not replace gathering your own obligations in the legal register; it only checks whether a subject area is missing there.
The source is a rule, not an operating event
A compliance risk differs from an operational risk in its source: a binding rule set by a legislator, a supervisor, a contracting party or the organisation itself.
| Feature | Compliance risk | Operational risk |
|---|---|---|
| Source | binding obligation from law, supervisory rules, a contract or a standard the organisation has chosen | processes, people, systems, external events |
| What changes it | a change in the law, even with no event inside the company | operating events, changes to processes and systems |
| Acceptance | limited: breaching mandatory law is not a permissible risk decision | possible where treatment costs more than the expected loss |
| Detection | also through whistleblowers, tax audits, customer audits and supervisors | through your own monitoring and incident reports |
Operational risks such as a system outage are handled by a business continuity management system.
The assessment of a compliance risk goes out of date with every change in the law, even when nothing has happened inside the company. Check the legal register for changes in the law at every review round (step 8).
How Rizzqo ties compliance risk to the object
Rizzqo models a compliance risk on the object to which the underlying requirement applies. Frameworks such as DORA and the CRA are held as requirement catalogues. Their requirements appear on systems, services and providers, where they are answered and finalised with name and timestamp. Every open requirement is therefore an addressed finding on a named object.
The risk assessment of an object shows its finalised, unmet requirements. The risk level follows from a configurable matrix, so management can see why one finding ranks above another.