What is compliance? A practical guide to compliance risk management

Data protection, health and safety, tax, employment law, card payments, anti-bribery, the terms in your biggest customer’s contract — a small business is subject to more obligations than anyone has written down. Compliance risk management is how you find them, decide which ones could really hurt, and prove you are meeting them without hiring a department.

By Alex Martyushin, founder & risk consultant · Updated 30 October 2026 · 16 min read

What compliance means for a business

In everyday business use, compliance is the state of doing what you are required to do, plus the processes that keep you there. The requirements come from two directions:

• Mandatory obligations — things imposed on you: laws, regulations, regulator rules and guidance, licence and permit conditions, court orders.
• Voluntary obligations — things you chose to commit to: contracts with customers and suppliers, industry codes, certifications such as ISO 27001, your own policies and public statements.

ISO 37301:2021, the international standard for compliance management systems, uses exactly this split: “compliance requirements” you have to meet and “compliance commitments” you choose to meet. Both count, because breaking either can cost you money, customers or your licence to operate.

Regulatory compliance

Regulatory compliance is the subset that deals with laws and regulators. It is the part most people mean when they say “compliance”, and the one with the sharpest consequences: fines, enforcement notices, director disqualification, criminal liability in some cases. For a typical small or mid-size business the main regimes are data protection, employment and health and safety, tax, consumer protection, anti-money laundering if you are in scope, and any sector licence. Our separate guides cover the detail of specific regimes, such as the GDPR compliance checklist and the PCI DSS checklist; this guide is about the system that holds them together.

Compliance is not the same as ethics — but it overlaps

Something can be legal and still damage trust; something can be ethical and still breach a technical rule. Good compliance programmes cover both: they make sure the rules are followed and that people know they can raise concerns. Regulators and prosecutors increasingly look at culture, not only at whether a policy exists.

Compliance in other contexts

Outside business, the word has broader meanings. In everyday English, compliance is doing what you are asked or told; in healthcare it describes whether a patient follows treatment advice. This guide is about the organisational sense: meeting the obligations that apply to a business.

Types of compliance

“Compliance” is usually qualified by the area it covers. The labels overlap, but they help you check that no whole category of obligations has been missed:

Where compliance obligations come from

What compliance risk is

Compliance risk is the likelihood and consequences of failing to meet a compliance obligation. Like any risk, it has causes (a process nobody owns, a law that changed, a supplier that cut corners), an event (the breach) and consequences (a fine, a lost customer, a news story). The consequences go well beyond the headline penalty:

• Financial — fines (under UK and EU GDPR, up to €20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious breaches; £17.5 million in the UK version), compensation, legal costs, remediation.
• Operational — orders to stop processing data, suspension of a licence, management time consumed by investigations.
• Commercial — enterprise customers dropping you after an incident or a failed audit.
• Personal — some offences carry personal liability for directors and officers.

Compliance risks belong in the same risk register as your operational, financial and cyber risks, scored on the same matrix. Keeping a separate compliance list with its own scale is the most common reason compliance risks are under- or over-prioritised relative to everything else.

Building a compliance obligations register

The obligations register is the foundation. Without it, compliance is a collection of things people happen to remember. Build it in four passes:

1. List activities. What do you do that regulators care about? Employ people, handle personal data, take card payments, sell to consumers, import goods, handle food, give advice, operate vehicles.
2. Map obligations to activities. For each activity, list the laws, rules, licences and contracts that apply. Trade associations, your accountant, your insurer and regulator websites are good free sources; specialist legal advice is worth paying for in regulated sectors.
3. Translate into requirements. “Comply with GDPR” is not actionable. “Respond to subject access requests within one month” is.
4. Assign and evidence. Give each requirement an owner, link it to the controls that meet it, and decide what evidence proves it.

A practical set of columns, with examples for a UK-based online retailer with 60 staff:

Keep the register current: assign someone to watch for regulatory changes (regulator newsletters and trade associations are usually enough for a small firm), and add new obligations when you sign a significant contract, enter a new market or launch a new product.

Assessing compliance risk and linking it to the risk register

Not every obligation deserves the same effort. Rate each one on two questions and you will quickly see where to focus:

• How likely is a breach? Consider complexity, how often the activity happens, manual steps, staff turnover, recent changes, past near misses and the strength of existing controls.
• How bad would it be? Consider the penalty regime, the regulator’s enforcement record, customer and contract consequences, and the people affected.

Obligations that score high go into the risk register as compliance risks, written in cause-event-consequence form — for example: “Because subject access requests arrive through several channels with no central log, a request could be missed, leading to a regulator complaint and enforcement action.” Each one gets the same treatment as any other risk: owner, controls, inherent and residual score, treatment plan and review date. See inherent vs residual risk for how to show the effect of controls.

The link should run both ways: the risk register entry points to the obligations it relates to, and the obligations register shows which risk entry covers it. That way, when a regulation changes, you can see immediately which risks and controls are affected.

Compliance monitoring

A policy that nobody checks will drift. Compliance monitoring is the ongoing work of confirming that obligations are actually being met, and its depth should follow the risk rating.

Useful compliance key risk indicators for a small organisation include: mandatory training completion rate; overdue policy reviews; access requests answered late; suppliers handling personal data without signed processor terms; certificates or licences expiring within 60 days; and open audit findings past their due date. Each needs a threshold and an owner who acts when it turns amber.

Record what you find. If an exception is fixed, note how. If it cannot be fixed quickly, it becomes or updates a risk in the register. Monitoring that produces no records cannot be shown to an auditor, a customer or a regulator.

What a quarterly compliance report should contain

Leadership does not need the whole obligations register every quarter. A one- or two-page report is enough if it answers the questions a director would be asked after something went wrong:

• Top compliance risks — the five to ten highest residual scores, with movement since last quarter and the reason.
• Breaches and near misses — what happened, whether it was reported to a regulator or customer, root cause and fix.
• Monitoring results — controls tested, exceptions found, actions overdue.
• Indicators — the agreed KRIs with their red, amber or green status.
• Regulatory change — new or changed obligations coming into force in the next six to twelve months and who is preparing for them.
• Decisions needed — risks that need budget, a change of process or formal acceptance by someone with the authority to accept them.

Minute the discussion and the decisions. A documented record that leadership saw and acted on compliance information is itself evidence of an effective programme.

Elements of an effective compliance programme

A compliance programme is the set of people, policies, controls and checks an organisation uses to meet its obligations and to detect and correct failures. Regulators and prosecutors describe what a good one looks like in similar terms. A widely used template is the seven elements in the US HHS Office of Inspector General’s General Compliance Program Guidance (November 2023), written for healthcare but easy to apply anywhere:

1. Written policies and procedures — a code of conduct and practical procedures for the high-risk areas.
2. Compliance leadership and oversight — a named compliance officer with authority and access to leadership, and oversight by the board or owners.
3. Training and education — tailored to roles, recorded, refreshed.
4. Effective lines of communication — ways to ask questions and raise concerns, including anonymously, without fear of retaliation.
5. Enforcing standards — consistent consequences for breaches, and incentives for doing the right thing.
6. Risk assessment, auditing and monitoring — a regular compliance risk assessment and checks that controls work.
7. Responding to problems and corrective action — investigating issues, fixing root causes and reporting where required.

The US Department of Justice asks three questions when it evaluates a corporate programme: is it well designed, is it adequately resourced and empowered to work, and does it work in practice? The last question is the one a paper programme fails. For a small business the seven elements can be very light — a two-page code, an annual briefing, a named person, a reporting email address, the obligations register and a quarterly review — as long as each one actually operates.

The compliance officer role

A compliance officer keeps the system running: maintaining the obligations register, advising managers, writing policies and training, monitoring, investigating breaches and reporting to leadership. In a large or regulated firm it is a full-time role, sometimes with a team. In a small business it is usually a hat worn by the finance director, operations manager or general counsel.

Some roles are required by specific laws in specific circumstances. Under UK and EU GDPR, a data protection officer is mandatory for public authorities and for organisations whose core activities involve large-scale regular and systematic monitoring of individuals or large-scale processing of special category data. Firms within the UK Money Laundering Regulations must appoint a nominated officer to receive suspicious activity reports, and financial services firms have their own required roles. Outside those cases, there is no general legal requirement to appoint a compliance officer — but someone must be clearly responsible.

Whoever holds the role needs three things: access to leadership, the authority to ask for evidence, and independence from the activities they monitor where possible. A compliance officer who reports to the person whose sales targets depend on cutting corners is in a difficult position.

Compliance, security and GRC: how they relate

Compliance is often confused with security and with risk management. They overlap, but they answer different questions:

You can be compliant and still insecure — a standard sets a minimum, and attackers do not read it — and you can be secure in ways no standard asks for. Compliance is best treated as one input to risk management: a requirement you must meet, and a source of risks when you might not.

GRC — governance, risk and compliance — is the name for running the three together. Governance sets direction, accountability and appetite; risk management identifies and treats what could go wrong; compliance makes sure obligations are met. In practice integrated GRC means one set of owners, one control library and one register, so a single control (say, multi-factor authentication) can be shown to satisfy a security standard, a customer contract and a data protection duty at once.

Frameworks and expectations worth knowing

• ISO 37301:2021 — compliance management systems; certifiable; replaced the earlier guidance standard ISO 19600. Useful as a structure even if you never certify.
• US Federal Sentencing Guidelines (§8B2.1) and the US Department of Justice’s Evaluation of Corporate Compliance Programs — set out what US prosecutors expect of an effective programme: risk assessment, policies, training, reporting channels, investigation, discipline and continuous improvement.
• UK Bribery Act 2010 — the section 7 corporate offence of failing to prevent bribery has a defence of “adequate procedures”; government guidance describes six principles, starting with proportionate procedures and risk assessment.
• UK Economic Crime and Corporate Transparency Act 2023 — the failure to prevent fraud offence came into force on 1 September 2025 and applies to large organisations (meeting two of: more than 250 employees, more than £36 million turnover, more than £18 million total assets). Again, reasonable prevention procedures are a defence.

The common thread: authorities judge you on whether your procedures were proportionate to your risks, which means a documented risk assessment is the starting point of any defensible programme. For how compliance fits alongside the other risk frameworks, see our comparison of risk management frameworks.

A 90-day plan for a small organisation

1. Weeks 1–3: list activities and build the first obligations register. Aim for completeness over precision.
2. Weeks 4–5: assign owners; rate each obligation for likelihood and impact of breach.
3. Weeks 6–7: move the top 10–20 into the risk register as compliance risks with controls and residual scores.
4. Weeks 8–10: fix the obvious gaps — missing processor contracts, absent logs, overdue training.
5. Weeks 11–12: set a monitoring calendar, choose five indicators and agree a quarterly compliance report to leadership.

Common mistakes

• Policies instead of controls. A policy says what should happen; a control makes it happen. Auditors test the control.
• Forgetting contracts. Customer contracts often impose stricter requirements than the law, especially on security and incident notification.
• Treating compliance as a separate world. Compliance risks scored on a different scale cannot be compared with other risks.
• No evidence. If it is not recorded, you cannot prove it happened.
• Annual box-ticking. Monitoring once a year finds problems eleven months late.
• Ignoring change. New products, markets and suppliers create new obligations.