Introduction
When compliance fails, the bill lands on the board's desk — not the compliance team's.
The SEC's fiscal year 2025 enforcement results underscore exactly what's at stake: 456 enforcement actions and $17.9 billion in monetary relief in a single year. That number isn't an abstraction. It represents organizations where leadership treated compliance as a periodic exercise rather than a governance function — and paid accordingly.
This guide goes beyond the textbook overview. It covers what regulatory compliance risk management actually requires, which frameworks matter and why, how to conduct a structured risk assessment, and what a board-ready compliance program looks like when it needs to hold up under scrutiny.
TLDR
- Compliance failures are governance failures — boards carry personal accountability, not just the compliance team
- Regulatory risk and compliance risk are distinct and require coordinated but separate responses
- COSO, ISO 31000, and NIST frameworks give boards a shared vocabulary for oversight questions
- A structured 5-step risk assessment is how organizations move from reactive to defensible
- Board-ready programs require named owners, stable dashboards, and 90-day execution roadmaps — built for execution, not shelf storage
What Is Regulatory Compliance and Risk Management?
Regulatory compliance risk management is the ongoing process of identifying which laws and regulations apply to your organization, assessing where failure could occur, and putting controls in place to prevent it — while ensuring leadership can verify those controls are working.
Three words in that definition matter most: ongoing, verify, and controls. Not annual. Not assumed. Not documented and filed away.
Regulatory Risk vs. Compliance Risk: A Key Distinction
These terms are often used interchangeably. They shouldn't be.
| Category | Regulatory Risk | Compliance Risk |
|---|---|---|
| Definition | Risk of harm from changes in laws, regulations, or standards | Risk of loss from failing to meet current requirements |
| Focus | Anticipation and adaptation | Prevention and detection |
| Example | New state privacy legislation that expands your obligations | Failing to follow existing HIPAA breach notification timelines |
| Board response | Monitor legislative landscape; assess strategic impact | Audit controls; close gaps; verify evidence |
Both require active management, and they must be coordinated. What starts as a regulatory risk — a bill moving through a state legislature, a new SEC rulemaking — becomes a compliance obligation on the day it takes effect. Organizations that treat these as separate functions typically discover that gap when it's too late to close it cleanly.
Why Regulatory Compliance Risk Demands Board-Level Attention
Compliance is no longer safely delegated down the org chart.
The SEC made this explicit when it adopted its Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure rules in July 2023. Regulation S-K Item 106 now requires public companies to describe — in annual filings — the board's oversight of cybersecurity risks and management's role in assessing and managing material threats. The disclosure isn't optional, and vague answers create their own exposure.
This is one regulation. Regulated industries face dozens simultaneously.
The Overlapping Framework Problem
Each industry carries its own layered obligations:
- Financial services: SOX, SEC disclosure rules, and a growing stack of state-level requirements
- Healthcare: HIPAA, state privacy statutes, and FTC enforcement actions
- Retail: PCI DSS v4.0.1, GDPR for EU customers, and CCPA — which covers any for-profit business in California with over $25 million in annual revenue or data on 100,000+ residents
Thomson Reuters Regulatory Intelligence tracks over 1,300 regulatory bodies and 2,500 regulatory materials globally. At that scale, informal compliance management isn't just inefficient — it's indefensible.
The Business Case for Proactive Compliance
PwC's 2025 Global Compliance Survey found that 75% of respondents now use technology for compliance and transaction monitoring — a direct response to manual processes becoming untenable. Yet 63% cite complexity and disaggregated data as their primary challenge.
Organizations that treat compliance as an annual audit exercise discover problems after they've become expensive. Late discovery means more systemic fixes, longer regulatory scrutiny, and reputational recovery work that rarely has a clean end date.
Compliance also belongs in strategic decisions before they're made. Entering a new market, completing an acquisition, or launching a new product all carry regulatory implications that leadership must weigh at the front end. When compliance enters the conversation only after a decision is final, the cost of correction typically dwarfs the cost of early counsel.
Major Regulatory Compliance Frameworks Boards Should Know
Frameworks give organizations a structured, repeatable method for managing compliance risk. They also give boards a shared vocabulary — so when a director asks "how are we managing this?" management can answer in terms everyone understands.
COSO Framework
COSO's Internal Control — Integrated Framework is the standard reference for financial reporting compliance and public company governance. It organizes internal controls around five components:
- Control environment — the tone, values, and accountability structures set by leadership
- Risk assessment — identifying and analyzing risks to achieving objectives
- Control activities — the policies and procedures that mitigate identified risks
- Information and communication — how relevant information flows up, down, and across the organization
- Monitoring activities — ongoing and periodic assessments of whether controls are functioning
SOX Section 404 compliance is built on COSO. If your organization files with the SEC, your internal controls program should be built around it.
ISO 31000
COSO addresses financial controls specifically. ISO 31000:2018 (confirmed 2023) covers the broader terrain — a principles-based standard applicable across industries and organization sizes that isn't tied to any single domain.
ISO 31000 works well for organizations that need a flexible, scalable approach rather than a sector-specific rulebook. It functions as the governance spine that connects multiple domain-specific frameworks.
NIST Frameworks
Two NIST frameworks matter most for organizations managing technology-adjacent compliance obligations:
- NIST Cybersecurity Framework 2.0 (released 2024) — a voluntary but widely adopted framework for managing cybersecurity risk, increasingly referenced by regulators and insurers as a maturity baseline
- NIST SP 800-37 Rev. 2 — the Risk Management Framework for information systems, providing a structured approach to risk assessment and authorization. Particularly relevant for organizations working with federal agencies or managing sensitive government-adjacent data
No single framework covers everything. The right selection depends on your industry, geography, and specific risk profile — which is why most mature organizations operate within two or three frameworks simultaneously rather than choosing one.
How to Conduct a Regulatory Compliance Risk Assessment: The 5-Step Process
Without a structured risk assessment, organizations cannot prioritize where to focus resources — or demonstrate to regulators and boards that risk is being managed systematically. This process is what separates a compliance program that holds up under scrutiny from one that looks functional until something goes wrong.
Step 1: Identify Compliance Obligations
Build a complete inventory of applicable laws, regulations, and standards — factoring in industry, geography, customer segments, and data types handled. HIPAA guidance from HHS, for example, requires covered entities to define the scope of analysis for electronic protected health information before any risk assessment begins.
This is not a one-time exercise. It requires a standing process for monitoring regulatory changes as they occur. Untracked regulatory changes become compliance exposure. Full stop.
Step 2: Define Scope and Prioritize Risk Areas
Determine which business units, processes, systems, and third-party relationships fall within scope. Then assign risk priority based on likelihood and potential impact.
High-attention areas in most organizations include:
- Customer data handling and storage
- Financial reporting processes
- Third-party vendor access to systems or data
- Cross-border data transfers
Not everything can be a priority one. Prioritization is where compliance programs either focus their resources effectively or spread them thin enough to protect nothing well.
Step 3: Assess and Rate Each Risk
Evaluate each identified risk by two dimensions: likelihood of occurrence and severity of potential impact — financial, reputational, operational, and legal.
The output is a risk rating that allows leadership to make defensible prioritization decisions. HHS guidance on HIPAA risk analysis follows this methodology directly: determine likelihood, potential impact, and resulting risk level. NIST, SOC 2, and most other frameworks follow the same sequence.
Step 4: Implement Controls and Assign Ownership
Develop policies, procedures, training, and technical safeguards to address high-priority risks. Every control requires two things that are routinely missing:
- A named owner — not a team or department, a person
- Measurable success criteria — what does "working" actually look like?
Without ownership, controls drift. Without success criteria, nobody notices when they've stopped working. In practice, the 90-day execution roadmap Tyson Martin uses with clients assigns a named owner and a due date to every control — and defines what "done" looks like before work begins. "Vendor committed to fix" is not done. "Evidence received and validated" is.
Step 5: Monitor, Report, and Improve Continuously
Compliance monitoring is not annual. NIST RMF includes a dedicated Monitor step; HHS guidance requires periodic review and updates when operations, regulations, or business conditions shift.
In execution, that translates to:
- Regular internal audits against the risk register
- Key risk indicator (KRI) tracking with trend direction, not just point-in-time scores
- Board reporting on a consistent cadence — not just when something goes wrong
- Risk register updates when regulations, operations, or conditions shift
Done consistently, this gives leadership the visibility to act before regulators or incidents make the decision for them.
Building a Compliance Program Boards Can Actually Inspect
A compliance program that exists on paper but cannot be demonstrated to a board, auditor, or regulator in real time is not a functioning program. It creates the appearance of control without the substance — and that distinction matters when regulators arrive.
Boards need stable, trend-based oversight rather than one-time snapshots or technical detail without context. The NACD's Director Essentials guidance on ethics and compliance oversight is explicit: directors need to understand whether a program is designed correctly, implemented consistently, and actually working — not just that one exists.
Structural Elements of a Board-Ready Program
Three elements separate inspectable programs from compliance theater:
1. Clear governance structure with defined decision rights Before a crisis, four questions need documented answers:
- Who accepts risk at what threshold?
- Who approves security exceptions and for how long?
- Who declares an incident and can authorize system shutdowns?
- Who owns vendor go/no-go decisions for critical suppliers?
Resolving these in the moment — under pressure, with incomplete information — is how governance breaks down.
2. Consistent reporting in plain language Board reporting should lead with what changed, what it means, what management is doing, and what decision is needed. A stable dashboard covering five outcome metrics gives directors the trend picture without burying them in activity counts:
- Material risk reduction
- Time to contain and recover
- Critical control coverage
- Security debt burn-down
- Third-party exposure
3. A 90-day execution roadmap with named owners Boards need something to inspect between meetings. A 90-day plan with named owners, due dates, and specific outcomes creates accountability that a narrative report cannot provide.
When Organizations Need External Stabilization
The three elements above are achievable — but not always from the inside. Organizations navigating leadership transitions, M&A activity, or post-incident recovery often lack the internal bandwidth to build or stabilize a compliance program quickly. A fractional CISO or board-level advisor can provide the structure and credibility needed to satisfy regulators, investors, and board members while the organization builds longer-term capability.
Tyson Martin is regularly engaged in exactly these situations. The first 30 days focus on triaging the biggest exposure points, establishing decision rights, and creating a board-ready reporting baseline. The 30-60-90 day structure converts a reactive posture into predictable execution — without requiring a full internal buildout before the work begins.
Common Compliance Failures That Create Avoidable Risk
Most compliance failures follow recognizable patterns. Three account for the majority of avoidable exposure:
Siloed Ownership
When compliance lives in Legal or IT rather than across the C-suite, critical risks fall through jurisdictional gaps. PwC's 2025 survey found that 63% of respondents cite complexity and disaggregated data as the main challenge — a direct consequence of fragmented ownership. Cross-functional accountability, with the board setting the standard, is the structural fix.
Reactive Posture and Infrequent Assessment
Organizations that only assess compliance risk annually or in response to an audit finding consistently discover problems too late to correct them cheaply. Continuous monitoring surfaces issues while they're still correctable. LRN's 2025 Ethics and Compliance Program Effectiveness Report found that high-impact compliance programs are 1.9x more likely to use benchmarking data and advanced analytics tools compared to medium-impact programs.
Weak Third-Party Risk Management
Vendors, partners, and service providers extend an organization's compliance obligations, and their failures become the organization's failures. LRN's research found that high-impact programs are 2.3x more likely to prioritize third-party due diligence and ongoing audits.
Most organizations under-tier their vendor population, giving low-impact relationships the same attention as payroll processors and customer data platforms — and missing the concentrated exposure in their most critical partnerships.
Frequently Asked Questions
What is regulatory compliance and risk management?
It's the ongoing process of identifying which laws and regulations apply to your organization, assessing where failure could occur, and maintaining controls that prevent it. It covers both the obligations (what you must do) and the management discipline (how you ensure it gets done).
What are the 5 steps of the risk management process?
Identify risks, assess and rate them by likelihood and impact, implement controls with named owners, monitor effectiveness through ongoing audits and KRIs, and report and improve as conditions change. These steps form a continuous cycle, not a linear sequence with a fixed endpoint.
What is the framework of compliance risk management?
Frameworks like COSO, ISO 31000, and NIST give organizations a structured approach to identifying, assessing, and mitigating compliance risks. The right choice depends on industry, geography, and organizational context. Most complex organizations use multiple frameworks in combination.
What are the 4 types of risk management?
Risk avoidance (don't engage in the activity), risk reduction or mitigation (implement controls), risk transfer (insurance or contractual liability shifting), and risk acceptance (consciously tolerate the exposure). Compliance programs combine all four depending on risk severity and the cost of available controls.
What is ISO 31000 vs. NIST SP 800-37?
ISO 31000:2018 is a principles-based international standard for enterprise risk management, applicable across any industry or organization size. NIST SP 800-37 Rev. 2 is a US framework specifically for managing security and privacy risk for information systems, most common in federal-adjacent or regulated-data environments.
What are the requirements for compliance risk management?
At minimum, organizations need a documented risk assessment process, clear policies and controls with defined ownership, ongoing monitoring and audit capability, and board-level reporting on a consistent cadence. Specific requirements vary by industry and jurisdiction.
