Policies mandated, but not updated regularly Regular management monitoring reviews are performed, but not documented Regular training is provided to the identified responsible person(s), but not documented * May only occur in exceptional circumstances Regular management monitoring reviews are performed and documented Regular mandatory training is provided to the identified responsible person(s)* and is documented

Since this scenario could become a daily (or at least weekly) occurrence and have significant short-term and long-term impact, it should be prioritized to fix.įigure 1: Likelihood of Occurrence Factors Likelihood of Occurrence Factors It also could make a lot of employees angry, cause a tremendous amount of bad publicity, and a possible Department of Labor or Internal Revenue Service audit. Your business would face substantial punitive fines as well as a requirement to pay lost wages and attorney fees. In contrast, noncompliance with the law regarding payment of overtime to your employees every week for a period of years, which in the United States is a violation of the Fair Labor Standards Act, could have a devastating impact. Rather, this scenario of an unlikely incident coupled with a low impact caused by the incident means that this noncompliance issue is probably one you will deal with later. Of course, this does not mean that you should ignore this risk. If the likelihood of an occurrence of noncompliance is every five years and the impact on the firm is minimal (say, a fine of $1,000), this risk would be relatively low in terms of concern to the business. It is both the likelihood and the impact of occurrence that will help your compliance team determine how the business will prioritize the compliance risks. Impact of occurrence is the degree to which a noncompliant incident will have a negative effect on the business in terms of financial resources being depleted, your CEO going to jail, damage to the corporate reputation in the eyes of the public, or even a more practical issue-a data breach resulting in disclosure of personally identifiable information (PII). In general, likelihood of occurrence is the probability that noncompliance with a law or regulation will occur daily, monthly, yearly, once every five years, ten years, etc.

Risk probability vs impact matrix