Regulatory non-compliance
Failure to comply with applicable laws or regulations.
The risk event
Failure to comply with applicable laws or regulations
A material breach of legal or regulatory obligations, identified internally or by the regulator.
What could cause it, and what stops it
The left-hand side. Each cause is a plausible pathway to the event; the controls beneath it are the barriers that reduce the chance of that pathway completing.
New or changed regulation missed
A regulatory change is not detected and acted on in time.
- Regulatory horizon scanningDetective · Limited
Subscription service for regulatory updates.
- Legal advisor retainerPreventive · Effective
External counsel retained for material change reviews.
Internal control failure
An existing control to ensure compliance breaks down.
- Control self-assessmentsDetective · Limited
Quarterly attestation by control owners.
- Internal audit programDetective · Effective
Risk-based internal audit coverage.
- Exception reportingDetective · Limited
Automated alerts on out-of-tolerance activity.
Process drift over time
Manual processes drift from compliant design.
- Periodic process reviewsDetective · Limited
Annual reviews of critical processes.
- Control automationPreventive · Planned · 6 to 12 months
Replacing manual checks with system-enforced controls.
Inadequate staff training
Staff are unaware of compliance obligations.
- Mandatory compliance trainingPreventive · Limited
Annual e-learning with completion tracking.
- Role-based curriculumPreventive · Limited
Targeted training by role and risk exposure.
- Attestation trackingDirective · Effective
Annual personal attestation of policy understanding.
What happens if it occurs, and what limits it
The right-hand side. Each consequence is an outcome the event could produce; the controls beneath it are what contains or recovers from that outcome once the event has already happened.
Fines and penalties
Monetary penalties imposed by regulators.
- Regulatory liaisonCorrective · Limited
Designated point of contact for regulator engagement.
- Voluntary disclosure protocolCorrective · Effective
Documented self-reporting workflow.
Operating licence at risk
Risk of suspension or revocation of operating authority.
- Licence renewal calendarPreventive · Effective
Tracked obligations and renewal cycles.
- Regulator engagement programPreventive · Limited
Proactive relationship with regulators.
Reputational damage
Adverse publicity from public regulatory findings.
- Stakeholder communication planCorrective · Limited
Pre-prepared messaging for adverse findings.
- Public disclosure governanceDirective · Effective
Clear ownership of statutory disclosures.
Remediation cost
Cost of investigation, fixes and ongoing oversight.
- Compliance budget contingencyCorrective · Limited
Budgeted reserve for unplanned remediation.
- External counsel panelCorrective · Effective
Pre-arranged panel for rapid mobilisation.
Where this template starts you
Ratings are a starting position, not a finding. They describe a generic organisation with the controls above in place; yours will differ, and the point of opening the template is to make them yours.
Make it yours
Opening the template loads it into the editor with everything above already in place. Rename the event, cut the causes that do not apply, and re-rate against your own matrix. Exports to PNG, PDF, Excel and PowerPoint are built in.