Quick Read
Clause 4.6 of ISO 37301 requires the organisation to identify, analyse and evaluate its compliance risks, relating them to its activities, products, services and operations, and to reassess them periodically and whenever there is material change. Most organisations answer this with a line on the enterprise risk register. That is not enough. A compliance risk assessment must be built from the obligations register, must express risks as specific breach scenarios, must distinguish gross risk from net risk, and must rest on controls that have actually been tested. This paper adapts the methodology Speeki set out for ISO 37001 bribery risk assessment to the broader world of ISO 37301.
Executive Summary
The compliance risk assessment is the engine of ISO 37301. It decides where controls are needed, how strong they must be, what training is delivered to whom, where internal audit looks and what the board is told. If it is wrong, the system is built precisely and expensively in the wrong place.
The failure pattern is the same one Speeki sees in anti-bribery risk assessments, magnified by the breadth of ISO 37301. Risks are assessed at the level of categories — data protection, sanctions, competition, health and safety — and scored on an enterprise heat map. The result looks orderly and tells no one what to do. A category cannot be controlled, a category cannot be tested, and a category cannot be traced back to an obligation.
An effective compliance risk assessment under Clause 4.6 does three things most assessments do not. It works at the level of specific breach scenarios derived from the obligations register. It distinguishes gross risk, before controls, from net risk, after controls. And it tests the controls it relies on before allowing them to reduce the score. Without all three, the assessment is a document rather than an analysis.
This paper explains what Clause 4.6 requires, how it relates to ISO 31000 and the enterprise risk framework, how to construct breach scenarios from obligations, how to score gross and net risk, how to evaluate and treat residual risk, and what Speeki’s auditors examine.
CORE ARGUMENT A compliance risk that cannot be described in terms of which obligation could be breached, by whom, in which activity, through what failure, is not a risk that has been assessed. It is a risk that has been acknowledged. |
1. What Clause 4.6 Requires
In substance, Clause 4.6 requires the organisation to:
Identify, analyse and evaluate its compliance risks, using the compliance obligations identified under Clause 4.5 as the basis.
Relate those risks to its activities, products, services and the relevant aspects of its operations.
Assess compliance risks related to outsourced and third-party processes.
Assess compliance risks periodically, and whenever there are material changes in circumstances or the organisational context.
Retain documented information on the risk assessment and the actions taken to address the risks.
Clause 6.1 then requires the organisation to plan actions to address those risks and integrate them into its processes, and Clause 8.2 requires controls to manage them. The chain is explicit: obligations in Clause 4.5, risks in Clause 4.6, planned actions in Clause 6.1, controls in Clause 8.2.
1.1 The relationship with ISO 31000 and enterprise risk management
ISO 37301 does not prescribe a methodology; Annex A.4.6 points to ISO 31000 for guidance and to IEC 31010 for techniques. ISO 31000 provides the recognised framework: identification, analysis and evaluation, followed by treatment, monitoring and review. ISO 37000 adds the governance dimension — the governing body defines risk appetite and must receive the outputs.
The compliance risk assessment should feed the enterprise risk register, not be replaced by it. Enterprise risk management operates at a level of aggregation suitable for strategic decision-making. Compliance risk assessment operates at the level at which controls are designed. Both are needed; they serve different purposes and the second rolls up into the first.
Level | Enterprise risk register | ISO 37301 compliance risk assessment |
|---|---|---|
Unit | Strategic risk (“material regulatory breach”) | Breach scenario tied to a specific obligation |
Owner | Executive risk owner | Operational owner of the obligation and control owners |
Purpose | Board-level prioritisation and capital allocation | Design and calibration of controls, training, monitoring and audit |
Controls | Referenced at summary level | Mapped and tested individually |
Relationship | Receives aggregated output | Provides aggregated output upward |
1.2 What carries over from ISO 37001
For organisations certified to ISO 37001, the methodology carries over almost entirely: scenario-level specificity, gross-to-net discipline, control testing, risk appetite and documented treatment. What changes is the input. In ISO 37001 the scenarios are generated from one risk — bribery — viewed through transactions, interactions and pressure points. In ISO 37301 they are generated from the obligations register, domain by domain. Anti-bribery scenarios simply become one domain within the broader assessment.
2. From Obligation to Breach Scenario
2.1 The breach scenario as the unit of analysis
A breach scenario is a specific, plausible description of how an obligation could be breached. It names the obligation, the activity or process in which the breach could occur, the role whose act or omission would cause it, the failure mechanism, the conditions that make it more or less likely, and the consequence. Annex A.4.6 speaks of compliance risk sources and compliance risk situations; a breach scenario is a compliance risk situation described precisely enough to be controlled and tested.
Domain | Category-level statement (insufficient) | Breach scenario (assessable) |
|---|---|---|
Data protection | Data privacy risk: high | Customer service staff in the regional contact centre fail to verify identity before disclosing account data over the phone, breaching the obligation to protect personal data from unauthorised disclosure, under call-volume targets. |
Sanctions | Sanctions risk: medium | A distributor onboarded through the fast-track process is not re-screened when its ownership changes, and becomes owned by a designated person while shipments continue. |
Competition | Antitrust risk: medium | Sales managers attending a trade association meeting exchange forward-looking pricing intentions with competitors during informal sessions outside the agenda. |
Regulatory reporting | Regulatory reporting risk: low | The quarterly return to the regulator is prepared by one individual using a spreadsheet; when that person is absent the return is filed late, breaching the licence condition. |
Safety compliance monitoring | Safety compliance risk: high | Findings from compliance monitoring audits of the safety management system are not escalated to the accountable manager within the required timeframe because the tracking system lacks overdue alerts. |
Each scenario on the right points directly to controls that can be designed and tested. None of the statements on the left does.
2.2 Generating scenarios: four lenses
For each obligation, or group of related obligations, four lenses generate a credible scenario set.
Lens | Question | Typical sources |
|---|---|---|
Process walk-through | Where in the process could the obligation be missed, misapplied or deliberately bypassed? | Process maps; workshops with operators; control owners |
Pressure points | What targets, deadlines, incentives or resource constraints create pressure to cut corners? | Incentive plans; KPI dashboards; staffing data |
Change and complexity | Where are new systems, new markets, new products or manual workarounds creating gaps? | Change register; IT projects; obligations register change log |
History and intelligence | Where have breaches, near misses, complaints or enforcement actions occurred — here or in peers? | Incident and speak-up data; regulator publications; internal audit findings |
2.3 Proportionality across a broad register
A broad ISO 37301 scope can contain hundreds of obligations. Not every obligation needs bespoke scenarios. A practical approach is two-tier: a screening assessment scores every obligation on consequence of breach and exposure, and full scenario development is reserved for obligations above a defined threshold. The screening, the threshold and the rationale must themselves be documented so that an auditor can see why an obligation received light-touch treatment.
AUDITOR’S VIEW Proportionality is legitimate; arbitrariness is not. Speeki’s auditors will accept that low-consequence obligations are assessed at screening level, provided the screening criteria are documented and applied consistently, and the threshold was set before the results were known. |
3. Gross Risk, Controls and Net Risk
3.1 Gross risk
Gross risk is the level of risk before any controls are applied — what Annex A.4.6 calls inherent compliance risk, as distinct from residual compliance risk that existing treatment measures do not effectively control. It reflects exposure: how often the activity occurs, how complex it is, how much pressure surrounds it, and how severe the consequence of breach would be. Many organisations skip it and score risk with their existing controls already assumed. That conflation hides the control framework. If you only see net risk, you cannot tell whether your controls are doing any work.
Score | Likelihood (before controls) | Consequence of breach |
|---|---|---|
5 | Almost certain — high-volume activity, complex rules, strong pressure, known breach history | Licence revocation, criminal liability, regulator-imposed restrictions, major penalties, loss of key customers |
4 | Likely — frequent activity with discretion or manual steps | Significant regulatory enforcement, material penalties, national media |
3 | Possible — periodic activity, moderate complexity | Regulatory investigation, remediation orders, contractual penalties |
2 | Unlikely — infrequent, well-defined activity | Self-reportable breach with limited external impact |
1 | Rare — exceptional circumstances only | Administrative correction, negligible impact |
Consequence should be taken from the obligations register, where the consequence of breach is recorded at source. Where consequence differs across dimensions — legal, financial, operational, reputational — use the highest, not the average. Annex A.4.6 lists the consequences to consider, including personal and environmental harm, economic loss, reputational harm, administrative changes, and civil and criminal liability.
3.2 Mapping and testing controls
Controls are then mapped to each scenario. Every control relied upon to reduce gross risk must be tested on three questions: is it designed adequately for the scenario, is it implemented as designed, and has it operated effectively over the period? A control that has not been tested is a hypothesis. A net risk score based on untested controls is a statement of hope.
Effectiveness rating | Meaning | Effect on likelihood |
|---|---|---|
Effective | Designed, implemented and operating consistently, supported by test evidence | May reduce by 2–3 points |
Partially effective | Designed adequately but gaps in coverage, frequency or consistency | May reduce by 1 point |
Ineffective | Exists on paper; testing shows it does not operate reliably | No reduction |
Not in place | No control addresses the scenario | No reduction; record as a gap |
3.3 Net risk and the consequence floor
Controls primarily reduce likelihood, not consequence. If a sanctions breach occurs despite good screening, the legal consequence is largely the same. Scenarios with catastrophic consequence therefore retain material net risk even with effective controls. That is not a failure of the assessment; it is the honest result, and it should drive more intensive detective controls and monitoring for those scenarios rather than a pretence that the risk has been eliminated.
Element | Gross | Net |
|---|---|---|
Scenario | Distributor ownership changes to a designated person; no re-screening; shipments continue | Same scenario |
Likelihood | 4 — large distributor network, fast-track onboarding, ownership data not refreshed | 2 — automated ownership-change alerts; quarterly re-screening of full distributor base; shipment hold on alert |
Consequence | 5 — criminal exposure, export privileges, banking relationships | 5 — unchanged by controls |
Score | 20 — Extreme | 10 — High |
Controls relied on | — | Ownership alerts: effective. Quarterly re-screening: effective. Shipment hold: partially effective (manual override used twice without approval) |
Treatment | — | Remove manual override or require compliance approval; monthly exception reporting to compliance function |
4. Evaluation, Appetite and Treatment
Risk evaluation compares net risk against criteria set by the governing body. In compliance, appetite has a particular shape. The organisation typically has no appetite for knowing breach of its obligations, but must still decide how much residual control risk it will carry, how intensely it will monitor high residual risks, and at what level risks are escalated. Annex A.4.6 is explicit that a risk-based approach does not mean the organisation accepts non-compliance in low-risk situations: it focuses attention and resources on higher risks first, and all identified compliance risks remain subject to monitoring and treatment. Appetite thresholds therefore govern how intensively a risk is treated and who is told — not whether a breach is tolerated.
Net rating | Position | Response | Reported to |
|---|---|---|---|
Extreme | Outside appetite | Immediate treatment; consider suspending the activity | Governing body |
High | Outside normal appetite | Time-bound treatment plan; enhanced monitoring | Top management; compliance committee |
Medium | At the boundary | Monitor control effectiveness; review treatment annually | Management review |
Low | Within appetite | Standard monitoring | Compliance function |
Treatment options follow ISO 31000: avoid the activity, reduce the risk with stronger or additional controls, share the financial consequence through insurance or contract, or accept the residual risk. Acceptance must be an explicit, documented and authorised decision at a level commensurate with the risk. An undocumented acceptance is not a decision; it is an omission.
TREATMENT THAT IS NOT TREATMENT “Enhance awareness” and “strengthen compliance culture” are aspirations. A treatment specifies the action, the owner, the completion date, the evidence of completion and when the control will be re-tested. |
5. Process, Cadence and Triggers
5.1 Who does the assessment
The compliance function leads and owns the methodology, but cannot assess compliance risk alone. Operational owners of obligations understand where breaches could occur; control owners know how controls actually perform; internal audit and the speak-up and investigations function bring evidence of what has gone wrong. Local management must be involved where obligations vary by jurisdiction.
5.2 When it is reassessed
Clause 4.6 requires periodic reassessment and reassessment on material change. A full annual reassessment, with event-driven updates in between, is the common pattern. Triggers should mirror those for the obligations register — new law, new market, new product, acquisition, outsourcing — plus changes in strategy or structure, significant external changes, mergers and acquisitions, and any non-compliance or near miss. Annex A.4.6 notes that even a single incident of non-compliance can constitute a material change in circumstances. Significant speak-up reports, internal audit findings and enforcement against peers belong on the trigger list too.
Step | Output |
|---|---|
Confirm scope, criteria and appetite | Approved criteria and appetite statement |
Screen all obligations | Screening scores and threshold rationale |
Develop breach scenarios for obligations above threshold | Scenario library linked to obligation IDs |
Score gross risk | Gross register with rationale |
Map and test controls | Control map, test evidence, effectiveness ratings |
Score net risk and evaluate | Net register; scenarios outside appetite |
Plan treatment | Owned, time-bound treatment plans |
Approve and integrate | Approval record; inputs to training, monitoring and internal audit plans |
6. Implementation Roadmap
The compliance risk assessment is usually the longest piece of work in a first certification, because it depends on the register and drives everything after it. A realistic cycle for the first assessment is set out below; subsequent annual cycles are considerably faster because the scenario library already exists.
Step | Activities | Output |
|---|---|---|
1. Criteria and appetite | Agree likelihood and consequence scales, the risk matrix and appetite thresholds with top management; confirm reporting of results to the governing body. | Approved risk criteria |
2. Prioritise the register | Apply a first-pass screen so that high-consequence obligations receive scenario-level analysis and lower-consequence obligations are assessed at group level. | Assessment plan |
3. Scenario workshops | Run workshops with obligation owners using the four lenses; write breach scenarios that meet the specificity test. | Scenario library |
4. Gross scoring | Score each scenario before controls, documenting rationale. | Gross risk register |
5. Control mapping and testing | Map existing controls; test design, implementation and operation for every control relied on. | Control test log and gap list |
6. Net scoring and evaluation | Apply test results; compare with appetite; decide treatment. | Net risk register and treatment plans |
7. Approval and integration | Top management approves; results feed objectives, training, the audit programme and monitoring. | Approved assessment, linked to the CMS |
7. Common Failures
Failure | Why it undermines the assessment | What a sound assessment does instead |
|---|---|---|
Re-using the enterprise risk register | ERM entries sit at strategic level (“regulatory risk”) and cannot drive control design. | Uses ERM for alignment of scales and escalation, but assesses breach scenarios obligation by obligation. |
Assessing only the obligations the compliance team knows well | Risk concentrates in areas no one has looked at, often operational or contractual obligations. | Starts from a complete register and screens every obligation before deciding the depth of analysis. |
Copying the anti-bribery method without adapting consequence scales | Consequence for a missed regulatory filing differs in kind from a bribery prosecution; one scale distorts both. | Keeps the method but calibrates consequence descriptors across the obligation domains in scope. |
Net scores based on untested controls | Residual risk is overstated as low; the assessment becomes an expression of confidence. | Relies only on controls with documented test results. |
Ignoring outsourced and third-party processes | Clause 4.6 expressly extends to them, and outsourced activity is where many breaches occur. | Includes scenarios for outsourced processes and third parties acting for the organisation. |
No trigger-based reassessment | A material change in law, business model or incident history goes unassessed until the annual cycle. | Defines trigger events and evidences reassessment when they occur. |
8. What Speeki’s Auditors Examine
Traceability. Can every high-rated scenario be traced to an obligation in the register, and can every high-consequence obligation be found in the assessment?
Specificity. Are scenarios specific enough to drive controls, or are they categories?
Gross-to-net discipline. Is gross risk scored independently of controls, with rationale?
Control testing. Is there evidence that controls relied upon were tested, and do test results justify the effectiveness ratings?
Appetite and acceptance. Are risk criteria and appetite defined and approved at the right level (Speeki expects the governing body to set appetite), and are acceptance decisions documented and authorised?
Currency. Has the assessment been updated after material changes and incidents in the period?
Use. Does the assessment visibly drive training content, monitoring priorities and the internal audit programme?
Speeki tests these by following individual scenarios end to end and, where evidence is held electronically, by testing full control populations rather than samples. If the assessment says a control is effective, the auditor expects the evidence to show it operated every time it should have, not just in a selected sample.
AUDITOR PERSPECTIVE An auditor is not looking for a risk assessment document. The question is whether the organisation knows where its obligations are most likely to be breached and has built controls that demonstrably work there. |
Conclusion
Compliance risk assessment under ISO 37301 is the bridge between knowing what the organisation is obliged to do and deciding how to make sure it does it. Built from the obligations register, expressed as specific breach scenarios, scored gross and net, and grounded in tested controls, it gives every other element of the system a reason to exist.
Organisations with a mature ISO 37001 bribery risk assessment already have the method. The task is to apply it to a wider register, proportionately, and to keep it current as the business and its obligations change.
About Speeki
Speeki is an accredited certification body operating across more than 100 countries, providing ISO management system certification, ESG and sustainability assurance, and executive education. Speeki provides no consulting of any kind. Our independence is structural, not a promise.
Speeki delivers its audits through AI working alongside a body of experts. Nicole, Speeki’s AI team member, works with our auditors to test full populations of evidence rather than samples, so that certification reflects how a management system actually performs, not how it looks on the day of the audit.
To learn more, see ISO 37301 certification with Speeki.
Related Reading
Paper 6 — Documented Isn’t Operating: Controls and Indicators (Clauses 8.2, 9.1.3)
Anti-Bribery Risk Assessment: ISO 37001 Clause 4.5 Framework and Methodology
This whitepaper provides general information on ISO 37301:2021 and does not reproduce the text of the standard. Organisations should refer to the published standard for its exact requirements.