Compliance risk is the threat posed to a company's earnings or capital as a result of violation or non-conformance with laws, regulations, or prescribed practices. Companies that fail to comply with the necessary standar

The steps in compliance risk management are as under: Understand compliance obligations : The primary element to manage compliance is to understand compliance obligation in the light of strategic goals and objectives. Compliance obligations stem from: Laws and regulations, industry or generic standards, internal policies, processes and procedures and contracts executed with clients and other stakeholders. It is important to understand that obligations are either requirements or commitments. Obligations that an enterprise has no control over are termed as compliance requirements, for example, one resulting from new laws and regulations. While obligations that an enterprise may choose to abide by - for example certain industry standards or best practices - are termed as compliance commitments. Here, a mechanism to ensure compliance obligations are kept up-to-date must be established. An enterprise may choose to restrict the scope of compliance management to compliance requirements but for a higher assurance, it may include compliance commitments, too. Assess risks : Once compliance obligations are established, a compliance risk assessment exercise should be undertaken to identify risks, causes, the areas they impact and the consequences thereof. An analysis to have better understanding of the risks should follow. Such an analysis should consider the factors affecting the consequences and likelihood of these consequences occurring as well as the controls in place. After receiving an analysis of the level of risk involved, a compliance risk evaluation should be done to take appropriate decisions on treatment. This exercise is not only a tool to accept the presence of risk but can effectively use to prioritize the treatment. Compliance risks analyzed as low should also be monitored and subjected to corrective action for a timely precaution. Address all compliance risks : An enterprise should ensure an effective action plan to address all compliance risks with clear ownership, responsibility, accountability and closure timelines. This can be driven with ease, if the enterprise ensures a documented compliance policy, objectives, processes and procedures. Further, compliance responsibilities must be clearly identified, assigned and established as part of the job descriptions at different levels. To ensure risks are addressed effectively, the management should ensure that all employees with compliance obligation are competent. Periodic training and awareness must be carried out and any other medium to communicate assigned responsibilities should be explored. A continuous communication mechanism is required to ensure all employees understand compliance and contribute to it by reporting risks and discharging their responsibilities effectively. Evaluate performance : A mechanism to measure and monitor the performance of the compliance practices and its impact on strategic goals and objectives must be developed. Developing compliance performance indicators is one of the tools. It can be as simple as the number of employees trained on compliance practices to mature indicators such as risks of non-compliance and trends. Feedbacks from clients, stakeholders, suppliers, vendors, employees and government agencies are a good source of data to ascertain compliance performance. Governance mechanisms, in the form of management reviews, internal audits and periodic compliance reporting, give great insights on the performance of compliance practices