Topics in this domain
- Exam Technique: Thinking Like a Risk Practitioner
- Aligning IT Risk Management with Business Strategy
- Organisational Structure, Roles and Decision Rights
- Risk Ownership and Accountability
- Segregation of Duties
- Risk Culture and Tone at the Top
- Ethics and Professional Conduct
- Policies, Standards, Procedures and Guidelines
- Policy Lifecycle, Exceptions and Enforcement
- Business Process Review: Ownership and Criticality
- Identifying and Valuing Organisational Assets
- Embedding Asset Management into Risk Governance
- Enterprise Risk Management: Purpose and Principles
- The Risk Practitioner's Role in ERM
- The Three Lines Model and Risk Oversight
- Risk Management Frameworks: ISO 31000, COSO ERM, NIST and COBIT
- Applying a Framework: the Risk Management Life Cycle
- Risk Appetite, Tolerance and Capacity
- Establishing and Maintaining the IT Risk Profile
- Making Risk-Based Business Decisions
- Legal, Regulatory and Contractual Requirements
- Connecting Governance to Risk Outcomes
Legal, Regulatory and Contractual Requirements
Where obligations come from
From obligation to control
Legal counsel interprets the law; the risk practitioner turns the requirements into risks, controls, owners and evidence.
Compliance risk is a risk
Non-compliance has a likelihood and an impact: fines, lost licences, lost contracts and reputational damage. It goes in the register and is assessed, prioritised and treated like any other risk, compared with appetite.
Example. A payments company finds it can’t meet a new rule on reporting incidents within four hours. The practitioner records it as a compliance risk, rates the impact using the regulator’s penalty regime, and the COO funds an incident reporting tool.
Working across borders
- Identify which laws apply where data and customers are.
- Build a common control baseline that meets shared requirements.
- Add local controls where laws are stricter.
- Get legal advice where rules conflict.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| FIRST step with a new regulation | Determine with legal counsel how it applies |
| Who interprets the law | Legal counsel |
| How to manage many obligations | A register mapped to controls and owners |
| Compliance versus risk | Compliance is a minimum; risk management goes further |
In short
- Obligations come from laws, sector regulation, contracts, listing rules, certifications and internal policy.
- Legal counsel interprets the law; the risk practitioner turns obligations into risks, controls and owners.
- Non-compliance is a risk with likelihood and impact (fines, lost licences, lost customers, reputation).
- Keep a register of obligations mapped to controls and owners, and review it as rules change.
- Multinationals face overlapping and sometimes conflicting rules; map them and use a common baseline with local additions.
Exam traps
- Treating compliance as the whole of risk management.
- Interpreting the law without legal counsel.
- Following only the headquarters country's laws.
- Waiting for an audit finding to discover a new requirement.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Where obligations come from
From obligation to control
1 / 8