Risk Assessment and Compliance Risk Management
What the domain tests
Compliance risk is the risk of legal or regulatory sanctions, financial loss, or reputational harm from failure to comply. Candidates must know how to build a risk assessment: identify inherent risk, evaluate control effectiveness, and derive residual risk. Understand likelihood and impact scoring, risk appetite and tolerance, risk registers, heat maps, and the difference between inherent and residual risk.
Concepts to master
Risk taxonomy and risk statements; qualitative versus quantitative scoring; data sources such as loss events, near misses, complaints, audit findings, and regulatory inquiries; emerging risk identification; risk aggregation across business units; and the annual or trigger-based refresh cycle. Know how a compliance risk assessment differs from an enterprise risk assessment: it focuses on regulatory obligations and conduct, not only financial exposures.
Traps
Questions often test whether you understand that residual risk depends on control effectiveness, not on the inherent score alone. A common error is treating a low inherent risk as requiring no controls; low-risk areas still need monitoring proportionate to risk. Another trap is confusing risk appetite (the level of risk the organization is willing to accept) with risk capacity (the maximum it can bear). Watch for answers that rank risks by dollar value alone without considering likelihood or regulatory consequence.
Worked example
A payments unit has an inherent risk score of high (4 of 5) because of cross-border transactions. Controls include automated screening and a trained team, rated effective, reducing residual risk to medium (2 of 5). The correct conclusion is that residual risk is acceptable within tolerance and monitoring frequency can be standard, not that the unit is high risk overall. Rule of thumb: inherent minus control effectiveness equals residual, and monitoring follows residual.
Exam focus
Expect questions on scoring methodology, risk appetite, and refresh triggers.