Use case · Annual compliance risk assessment
The external half of your annual compliance risk assessment.
Most annual risk assessments rely on internal workshops and questionnaires. We add what they cannot see: the enforcement environment, sector cases and country indicators for the markets you operate in, rated on a scale your risk register can use.
The situation
Every compliance management system rests on a risk assessment, and every recognised framework expects it to be repeated. In practice, the annual update is often a re-run of last year's workshop, with little new external information.
Auditors, certification bodies and authorities increasingly ask how the assessment reflects the company's actual footprint: its locations, its sectors and the enforcement it faces there.
Questions the analysis answers
- How has the external risk in our markets and sectors changed since last year?
- Which new laws, enforcement priorities or cases need to be reflected?
- Does the internal assessment match the external evidence, or are there blind spots?
- How do we document the assessment for auditors, certifiers and authorities?
- Which focus areas and countries deserve more control effort next year?
Typical scope
All material countries and sectors of the group, all seven focus areas or the subset covered by your compliance programme. The internal module links the external picture with your own cases, partners, sponsorships, donations, memberships and gifts and hospitality.
- First year: full baseline analysis
- Following years: update of ratings, new cases and changed indicators, with changes marked
What you get
- Ratings per country × sector × focus area on a 5-level scale
- Case register and indicator tables in the XLSX annex, ready for your risk register
- Mapping of findings to the risk-assessment requirements of the frameworks you follow
- Documented sources and rationale for audit and certification purposes
- Recommended priorities for the compliance programme
Frameworks this supports
The analysis is designed as input to the risk-assessment element of these frameworks. It does not replace your own assessment of controls.
- IDW PS 980
- German auditing standard for compliance management systems; compliance risks are one of its basic elements.
- ISO 37301
- Compliance management systems: requires a compliance risk assessment that is documented and reviewed at planned intervals and when circumstances change.
- ISO 37001
- Anti-bribery management systems: requires a regular, documented bribery risk assessment.
- US DOJ Evaluation of Corporate Compliance Programs
- Asks whether the risk assessment is current, uses data and lessons learned, and reflects the company's locations, sector and regulatory landscape.
- German Supply Chain Act (LkSG)
- Requires an annual and event-driven risk analysis of human-rights and environmental risks in the own business and at direct suppliers (§ 5 LkSG). Amendments to the act are pending; the proposals known to date keep the risk-analysis duty but may change which companies are covered.
We provide risk analysis, not legal advice. Whether your programme meets a specific standard is for your auditors and counsel to assess.
Questions on the annual assessment
Does the analysis make us ISO 37301 or ISO 37001 compliant?
No. It is input to the risk-assessment requirement of these standards. Certification depends on your whole management system and is assessed by an accredited certification body.
We already run internal risk workshops. Is this a duplication?
No. Workshops capture internal knowledge; the external analysis adds enforcement data, sector cases and indicators. The internal module can link both views in one rating.
How does the update in subsequent years work?
We re-assess the same scope with the same criteria, add new cases and changed indicators, and mark every rating that has moved. The scope can be extended at any time.
Tell us the decision you are preparing.
Send us your countries, sectors and the context of the decision. We come back with a scope proposal: fixed scope, timeline and price.