Compliance risk assessment under ISO 37301: a practical method

What is a compliance risk assessment?

A compliance risk assessment is the documented judgement of which of your compliance obligations you are most likely to fail, what the failure would cost you, and whether the controls you run today are enough. Under ISO 37301 it turns a long list of laws, licence conditions, contract terms and voluntary codes into a short list of priorities that leadership can resource and the compliance function can monitor. The output is a ranked set of risks, each tied to an obligation, an owner and the controls that manage it.

It is different from an enterprise risk register. Enterprise risk looks at anything that threatens objectives: markets, suppliers, technology, people. A compliance risk assessment looks only at the chance and the effect of not meeting an obligation, including the ones you chose to take on, such as a code of conduct or a customer's supplier charter.

Where the assessment sits in ISO 37301

The standard puts compliance risk assessment in clause 4.6, inside the context of the organisation, immediately after clause 4.5 on compliance obligations. The order matters. Clause 4.1 gives you the issues that shape your exposure, including, since Amendment 1:2024, whether climate change is a relevant issue; clause 4.2 gives you the interested parties and what they expect; clause 4.5 gives you the obligations. Clause 4.6 then asks which of those obligations carry real risk.

Almost everything that follows draws on the result:

• 6.1 Actions to address risks and opportunities and 6.2 compliance objectives take the higher risks as their starting point.
• 8.2 Establishing controls and procedures should show a control for each higher risk.
• 7.2.2 Employment process and 7.2.3 Training need to know which roles are exposed.
• 9.1 monitoring and indicators and the 9.2 internal audit programme are weighted towards the same risks.

If you have not yet built the register, start there: our guide to the compliance obligations register covers how to identify and maintain it. This guide assumes the register exists.

Setting the criteria before you rate anything

ISO 37301 does not prescribe a scoring model. Most teams borrow from ISO 31000, the risk management guideline, which describes a process of identifying, analysing, evaluating and treating risk. What an auditor expects is that your scales were agreed before the ratings were made, and that two people using them would reach similar answers.

Likelihood

Base likelihood on evidence, not instinct: how often the obligation is triggered, how complex it is, how much discretion people have, past breaches, regulator findings, concerns raised, audit results and how recently the requirement changed.

Consequence

Rate consequence across several dimensions and take the highest: regulatory action, loss or suspension of a licence, contract termination, financial loss, harm to people, reputational damage and personal liability for directors or officers. A breach with a modest fine can still be severe if it puts an operating licence at risk.

The threshold

Decide, in writing and with top management's approval, which ratings count as higher risk. Those are the risks that must have a named control, an owner, monitoring and a place in the audit programme.

The method, step by step

This is Sterling's recommended sequence.

Inherent and residual ratings are both worth keeping. Inherent ratings show where you would be exposed if a control failed; residual ratings show where effort is needed now.

Worked example: a mid-sized payments business

Consider a payments company with operations in two countries and a customer-service centre in a third. Four of them show how the method sorts priorities.

The second row is the one leadership needs to see: a control exists on paper but does not operate, so the residual risk stays high. That single finding drives a procurement change, a training need for a role nobody had thought of as compliance-exposed, and a line in the internal audit plan.

What auditors test, and the mistakes they find

A certification auditor usually starts from one obligation and traces it: into the risk assessment, to its rating and the reasoning, to the control, to evidence that the control runs, and to how the compliance report and the internal audit treated it.

• Ratings without reasons. A heat map of coloured cells with no explanation cannot be challenged or repeated.
• Everything is medium. When workshops avoid hard calls, the threshold selects nothing and effort is spread thinly.
• Controls assumed, not tested. A policy is listed as the control, but nobody checked whether people follow it.
• No link to the rest of the system. Higher risks that do not appear in training plans, indicators or the audit programme suggest the assessment was a one-off exercise.
• Stale dates. An assessment last reviewed before a new product launch or a new jurisdiction tells the auditor the system did not react to change, which clause 6.3 on planning of changes is meant to prevent.

Where bribery is one of your material risks and you also hold or plan ISO 37001, keep a single method and cross-reference the two; our ISO 37001 bribery risk assessment guide covers the bribery-specific units of analysis.

Keeping the assessment current

Set a regular cycle, most organisations choose annual, and name the events that trigger an earlier review: a new or amended law or licence condition, entry into a new market, a new product or channel, an acquisition or restructuring, a significant breach, a regulator finding, or a pattern in the concerns raised under 8.3. Each review leaves a dated record of what changed and why.

Feed the results upward. The compliance function should report the higher risks and their movement to top management and the governing body as part of compliance reporting, and management review should record the decisions taken on them. Our guide to the compliance function covers who owns that reporting line.

Compliance risk assessment: questions buyers ask