Compliance, Regulatory and Legal Risk
Compliance, Regulatory and Legal Risk
This domain tests whether you can turn a regulatory landscape into a managed obligation set. Expect questions on compliance risk, obligations registers, regulatory change, legal risk, and Nigerian requirements such as CAMA 2020 filings, data protection and anti-money-laundering duties.
Core rules
- Compliance risk is the risk of legal or regulatory sanctions, financial loss or reputational damage from failure to comply. Legal risk is broader: it includes contractual, litigation and regulatory exposure.
- Build an obligations register: source, requirement, owner, frequency, evidence, consequence of breach and status. Review it when laws or regulators change.
- Compliance is not a policy library. It requires monitoring, testing, escalation and remediation.
- In Nigeria, the Companies and Allied Matters Act 2020 governs company filings and corporate records; the Nigeria Data Protection Act 2023 imposes data-handling duties; the Money Laundering (Prevention and Prohibition) Act 2022 creates AML obligations for entities within scope. Sector regulators add rules.
Worked example
A company secretary maintains an obligations register. The annual return due date is entered with the owner and evidence required. Two weeks before the deadline, the compliance tracker flags 'not filed'. The team discovers a director’s details are outdated. They update the record and file before the deadline. If the deadline is missed, the register records the breach, the penalty exposure, the root cause and the remediation date. Reasoning: the register is useful only if it triggers action before the deadline, not after.
Traps
- Equating compliance with having policies on the intranet.
- Missing regulatory change because the register is not reviewed.
- Treating legal risk as only litigation.
- Recording an obligation without an owner or evidence requirement.