Does Risk Assessment Matter in Corporate Compliance Programs? An Empirical Study Examining the Impact of Risk Assessment on Corporations’ Compliance Programs

Corporations must comply with various laws and regulations, subject to their markets and industry. To manage their compliance risks, corporations are expected to design and implement compliance programs based on risk assessments. This study investigates the impact of risk assessments on the implementation of recommended practices in Corporations’ Compliance Programs (CCPs). Through survey interviews with compliance officers from 93 Forbes 2000 companies, the research examines the relationship between risk levels and 33 recommended practices across Anti-Bribery & Corruption, Data Privacy, and Third-Party compliance risks. Contrary to the initial hypothesis, findings reveal that only nine practices significantly relate to risk levels, including rule-based policies and compliance training testing. Unexpectedly, several practices showed negative relations, particularly in the Third-Party compliance domain, suggesting that higher risk levels do not always lead to broader implementation of recommended practices. The study uncovers mixed results in the Anti-Bribery & Corruption CCP, limited risk-based alignment in the Third-Party CCP, and better alignment in the Data-Privacy CCP. These findings suggest that the relationship between risk and compliance implementation is domain-specific and may be influenced by whether the risk is perceived as core (e.g., Data Privacy) or non-core (e.g., Third-Party). They highlight the need for improved regulatory alignment with corporate practices and further exploration of CCP impacts on risk management. This study offers a novel empirical contribution by systematically examining the link between risk levels and the implementation of specific compliance practices across three compliance areas, providing a granular benchmark for future research.