Compliance Risk Assessment and Control Testing Course
A Compliance Programme Is Not Effective Because the Policy Exists. It Is Effective When the Controls Work Against the Risks They Were Designed For.
Many compliance functions can list policies, training completions and hotline statistics.
The harder question is whether the programme is actually controlling the organisation's most important compliance risks.
ISO 37301 provides a management-system framework for establishing, implementing, evaluating, maintaining and improving compliance. The ISO governance catalogue now also includes ISO 37302:2025, dedicated specifically to evaluating compliance-management effectiveness. DOJ guidance similarly looks beyond the existence of a programme to whether it is well designed, resourced, tested, monitored and effective in practice.
That changes the job of compliance.
A risk assessment should drive the control environment. Controls should map to specific obligations and risk scenarios. Testing should generate evidence about whether controls are designed appropriately and operating as intended. Findings should be prioritised, remediated and retested. Monitoring should evolve as regulation, business models, third parties, products and geography change.
This course teaches that full risk-to-control-to-evidence cycle.
ISO 37301 · ISO 37302:2025 · U.S. DOJ Compliance Evaluation. Evidence is contextual and does not guarantee participant or organisational outcomes.
Compliance programmes become fragile when:
- obligation registers exist but are not connected to actual risk scenarios
- risk assessments use generic high/medium/low labels without a repeatable methodology
- compliance controls are copied from policy documents rather than designed around root causes
- teams confuse a control's existence with evidence that it works
- testing samples are chosen without a rationale
- first-line monitoring, compliance testing and internal audit duplicate one another
- findings are documented but not prioritised by residual risk
- remediation closes when an action is completed rather than when effectiveness is demonstrated
- business changes, acquisitions, products or third parties are not reflected promptly in the risk assessment
- dashboards count training and policy attestations but cannot show control effectiveness
- compliance cannot explain how its testing plan reflects the organisation's highest risks.
How This Applies Across the Markets MATSH Serves
GCC
Applications include regulated financial and non-financial sectors, government-linked organisations, multinational operations, anti-bribery and third-party exposure, rapidly evolving regulatory environments and increasing expectations around governance and evidence.
Africa
Participants consider multi-country regulatory obligations, varying control maturity, third-party and intermediary risks, distributed operations and how to build proportionate testing where compliance teams may be small.
Asia
Applications include complex regulatory footprints, high transaction volumes, third-party ecosystems and rapidly changing products or technology that require risk-based monitoring rather than static checklists.
Europe
Participants examine mature compliance environments, data/privacy, competition, financial crime, ESG and other regulated domains where documentation, defensibility and evidence of control effectiveness matter significantly. These are contextual lenses. Specific legal obligations must always be identified and interpreted for the relevant jurisdiction and business.
Who Should Attend
Compliance Officers and Compliance Managers
Designing risk assessments, monitoring plans or compliance-control testing.
Risk and Governance Professionals
Working at the interface between enterprise risk, compliance obligations and controls.
Internal Control Professionals
Responsible for control documentation, testing, remediation and management assurance.
Legal and Regulatory Affairs Teams
Needing a structured method for translating obligations into operational controls.
Internal Auditors Moving Into Compliance Assurance
Wanting to distinguish second-line compliance testing from independent third-line audit.
Business Control Owners
Responsible for demonstrating that compliance controls embedded in operations actually work.
What You Will Leave With
A complete compliance risk and testing framework.
Programme Curriculum
Why this module matters: Compliance testing cannot be risk-based if the organisation has not defined what obligations apply, where they touch the business and what failure could look like. Participants learn to:
- build a compliance-obligation inventory
- map obligations to entities, products, geographies and processes
- distinguish legal obligations, regulatory expectations, licence conditions, contractual commitments and internal policy
- translate obligations into specific risk scenarios
- define inherent-risk criteria
- evaluate likelihood and impact consistently
- include financial, legal, operational, customer and reputational consequences appropriately
- assess risk velocity and change where useful
- document assumptions and evidence behind ratings
- identify triggers for reassessment.
Workshop: Build a compliance-risk register from a sample obligation set.
Why this module matters: A policy statement is not a control. Effective compliance systems identify who performs the control, when, on what population, using which evidence and how exceptions are handled. Participants learn to:
- distinguish policies, procedures and controls
- identify preventive, detective and corrective controls
- map controls to specific risk causes and consequences
- define control owner, frequency, population and evidence
- assess whether a control is designed to address the stated risk
- identify gaps, duplication and over-control
- distinguish key controls from supporting controls
- consider manual, automated and IT-dependent controls
- assess residual risk after control design
- document accepted residual risk and escalation.
Workshop: Build a risk-control matrix and challenge the design of each key control.
Why this module matters: Testing needs a repeatable method. Without clear objectives, population, samples, evidence and pass/fail criteria, conclusions become subjective and difficult to defend. Participants learn to:
- distinguish business monitoring, compliance monitoring/testing and internal audit
- define the testing objective and control assertion
- assess design effectiveness before operating effectiveness
- identify test population and period
- choose samples proportionately to risk and frequency
- define inspection, observation, reperformance and inquiry procedures
- establish evidence sufficiency and quality
- record exceptions consistently
- avoid treating one successful sample as proof of effectiveness
- conclude on effectiveness using defined criteria.
Simulation: Execute and document a control test from planning through conclusion.
Why this module matters: Compliance findings create value only when the underlying weakness is corrected. Closing an action because a document was updated does not prove the risk is controlled. Participants learn to:
- classify findings by risk and control significance
- distinguish isolated exceptions from systemic failures
- investigate root causes
- write findings that connect condition, criteria, cause and risk
- agree remediation with accountable owners
- set realistic milestones and interim controls
- track overdue remediation
- determine when risk acceptance is appropriate
- retest controls after remediation
- close findings only when evidence supports sustainable effectiveness.
Workshop: Rewrite weak compliance findings and build a remediation/retest plan.
Why this module matters: A compliance-testing plan should evolve with the organisation. Static annual checklists become obsolete when products, third parties, technology, regulation or geographic exposure changes. Participants learn to:
- create a risk-based annual monitoring and testing universe
- allocate testing frequency based on risk and change
- use data analytics and exception monitoring where appropriate
- incorporate incidents, investigations and hotline trends into risk reassessment
- evaluate whether training and communications are addressing actual risk
- monitor third-party and transaction risks proportionately
- define programme-effectiveness indicators
- distinguish activity measures from evidence of effectiveness
- report control themes and residual risk to management and boards
- feed findings into continuous improvement of the compliance management system.
Capstone: Present a compliance risk assessment, control map and annual testing plan for a realistic organisation.
Common Questions
Compliance Confidence Should Come From Evidence, Not From the Absence of a Recent Incident.
Build the risk assessment and testing discipline to show whether your compliance controls are actually working.
We run this course as a private programme for organisations. Bespoke dates, tailored content, group pricing.
Every course starts with a needs assessment and includes structured follow-up at three points after it ends.
Related Courses
Employee Survey Design and People Listening Course → Organisation Design and Workforce Restructuring Course → Competency Framework Design Course → Sales and Operations Planning (S&OP) Course →Have a question about this course?
Get in Touch