Risk Of Compliance

The risk of compliance is the exposure an organisation carries because of the obligations that apply to it. Every law, licence condition, standard and internal policy creates a way of falling short. Managing that risk means recognising each exposure and deciding who owns it, before it turns into an incident.

Compliance risk is a category of business risk in its own right, sitting alongside financial, operational and strategic risk. What makes it awkward is that it is mostly non-financial in origin and it surfaces late. A conflict of interest known informally but never declared. A policy nobody has opened since induction. A near miss that went unlogged. None of these appear in a monthly report until they have already become a problem.

ASIC treats risk identification and management as a core responsibility of directors, including emerging risks. Its risk oversight resources, and Report 631 on director and officer oversight of non-financial risk, set out how boards are expected to monitor exactly this. The duty of care and diligence in section 180 of the Corporations Act applies to directors of companies of all sizes, not only listed ones, so smaller organisations should not read it as someone else’s concern.

In practice, the risk tends to show up and get managed through:

• Conflicts of interest that people know about informally but never record
• Competition and consumer law duties sitting with staff who were never trained on them
• Policy acknowledgement that shows who accepted which version, and when
• Incident reporting that surfaces near misses while they are still cheap to fix

Obligations differ across states and territories and change over time, so treat this as general information rather than legal advice and check anything contentious with your adviser. Browse Sentrient’s workplace compliance training courses to see how these topics are covered.