How to Conduct a Compliance Risk Assessment - Step by Step

A compliance risk assessment often takes weeks of spreadsheet work and ends with scores that nobody outside the core team can explain. When leadership or an auditor asks why one gap rated high and another rated low, the answer usually depends on who did the scoring that day.

A repeatable method fixes that. The seven steps below cover scoping, control walkthroughs, testing, finding write-ups, scoring, and sign-off, so the next person to run the assessment reaches the same conclusions you did.

Key takeaways

• A compliance risk assessment tests your controls against the obligations that apply to you and scores the gaps it finds
• Write a one-page scope statement before any testing starts, and list what sits out of scope
• Check each control’s design before you test whether it operates
• Write every gap in four parts: Condition, criteria, cause, and effect
• Record a one-line rationale for each score, so a second reviewer reaches the same number

What Is a Compliance Risk Assessment?

A compliance risk assessment is a structured review of how well your controls meet the laws, regulations, standards, and contracts that apply to you. It tests each control, records the gaps, and scores them by likelihood and impact, so you know which compliance risks to address first and can show how you decided.

The assessment is the evaluation step inside your broader compliance risk management process, which also covers how you treat, accept, and report each risk afterward. The assessment produces the evidence that every later decision depends on, so its method matters as much as its results.

Regulators increasingly look at that method. The US Department of Justice’s Evaluation of Corporate Compliance Programs (updated September 2024) asks prosecutors to check, among other things, “Is the risk assessment current and subject to periodic review?” It also asks whether that review relies on a one-time snapshot or on continuous access to operational data.

What Do You Need Before You Start?

Five inputs save the most time once testing begins. Gather them before you schedule a single walkthrough.

How Do You Conduct a Compliance Risk Assessment?

Compliance risk assessment runs in seven steps. Each one below covers what to do, what it produces, and one practical tip.

Step 1: Set the scope and the assessment period

Write a one-page scope statement that names the entities, frameworks, systems, and period under review. List what sits out of scope too, since an unstated exclusion reads as an oversight to anyone who reviews your work later.

Have the assessment sponsor, usually the CCO or GRC lead, sign the statement before testing starts. A signed scope stops the assessment from growing mid-stream, which is the most common reason assessments overrun.

Output: Signed scope statement

Step 2: Pull the obligations and controls in scope

Filter your obligation register down to the scope you just signed. Pair each obligation with its control and the control’s owner, and flag any obligation that has no control at all.

Obligations without a control are gaps already, so log them as findings now and move on. Spend testing time on controls that exist.

Output: In-scope control list with owners and unmapped obligations flagged

Step 3: Walk through each control with its owner

A walkthrough shows how a control actually runs, which often differs from how the policy describes it. Book 30 minutes with each control owner and ask five questions:

• What triggers the control, and how often does it run?
• Who performs it, and who reviews the result?
• Which system or tool does it rely on?
• What record does it leave behind?
• What happens when it finds an exception?

Write the answers into a short narrative for each control. These narratives become the baseline for testing and the starting point for the next assessment.

Output: Control narratives

Step 4: Test design first, then test operation

Run two tests on each control, in order. If a control fails the design test, log the gap and skip the operating test, since a poorly designed control cannot operate effectively.

Agree on sample sizes with internal audit before testing begins, so your results hold up if audit later relies on them. For the main testing approaches and when to use each, see this guide to compliance testing.

Pro tip: Test the controls linked to last year’s findings first. A control that failed once and received a rushed fix under deadline pressure is the one most likely to have slipped again.

Output: Test results for every in-scope control

Step 5: Write each gap as a finding

Vague findings such as “access reviews need improvement” stall remediation, because nobody can tell what to fix. Write every finding in four parts: the condition you found, the criteria it breaks, the cause, and the effect.

Here is a hypothetical finding written in that format:

The cause line matters most, since it tells the owner what to change so the gap does not come back.

Output: Findings log

Step 6: Score each finding for inherent and residual risk

Score each finding twice on your program’s likelihood and impact scale: once for the exposure before any controls (inherent risk), and once for the exposure left with controls as they currently operate (residual risk). If you need a refresher on the distinction, see this explainer on inherent risk vs residual risk.

Use the same scale your compliance risk management program already uses, so assessment scores feed directly into the risk register without conversion.

Pro tip: Write a one-line rationale next to every score, such as “manual control, failed last year, regulated personal data in scope.” A second reviewer reading that line should land on the same number, and that consistency is what makes the scores defensible.

Output: Scored findings log

Step 7: Validate with owners and sign off

Share draft findings with each control owner and give them a short window to correct facts. Accept factual corrections, and keep score changes for documented new evidence, since negotiated scores weaken every later decision.

Once owners confirm the facts, the sponsor signs the assessment and hands the findings to the risk treatment process. Set the date of the next assessment at sign-off, while the scope is still fresh.

Output: Signed assessment and next assessment date

The seven steps at a glance

Who Should Be Involved in the Assessment?

A compliance risk assessment needs four or five roles, and each one has a defined part to play. Here is how the work typically splits.

Keep the assessor independent of the controls under review where you can. When that is not possible in a small team, have a second person review the scores of any control the assessor also operates.

What Should the Assessment Report Include?

The assessment report records what you tested and what you found. Keep it to five parts:

1. The signed scope statement, including exclusions
2. The method used, covering the scoring scale, testing approach, and sample sizes
3. The scored findings log, with a one-line rationale for each score
4. A short summary of the highest-scoring findings
5. Sign-off details and the date of the next assessment

Leadership summaries and board reporting draw on this report but sit outside it. Keeping the method section in the report lets the next assessor repeat your work, which is what turns a one-off exercise into a program.

Where Do Compliance Risk Assessments Go Wrong?

Each pitfall below usually starts with good intentions and a tight deadline.

How ComplyScore® Supports Compliance Risk Assessments

Steps 2 through 6 work in spreadsheets for a single framework. Once an assessment spans several frameworks and dozens of control owners, keeping control lists, test results, findings, and scores consistent across files becomes the slowest part of the work.

ComplyScore® runs those steps in one place:

• Scope and framework selection: Define the entities and frameworks in scope, and start from 30+ frameworks, including ISO 27001, SOC 2, GDPR, HIPAA, and DPDP, or your own standards
• AI-assisted evidence review: AI reads uploaded policies, reports, and certificates, maps them to controls, and flags gaps for your assessor to confirm or reject
• Findings with owners: Each finding routes to its control owner with a deadline and automatic escalation
• Close-out reports: Reports generate from the workflow itself, dated and structured for review

Teams running assessments this way report 40 to 60% lower cost per assessment cycle.

Make Your Next Assessment Repeatable

A compliance risk assessment earns trust when someone else can follow your method and reach the same scores. Sign the scope first, test design before operation, write every finding in four parts, and record the reasoning behind each score.

See how ComplyScore®’s continuous compliance automation software runs your next assessment, or book a demo to walk through it on your own controls.

Get a demo today!