Every company assesses risk. This is not just a compliance issue. There are operational risks, competition risks and other risks that companies—from a business perspective—must control. The process is a familiar one.

But when it comes to compliance, I see too many programs overlooking the incredible benefits of a thorough risk assessment. Too often, compliance officers believe they know where their companies' risks are or don't see the value for the cost and ask for a “quick and dirty” risk assessment. 

A risk assessment done right provides significant benefits:

• Business buy-in to short-, medium- and long-term goals
• Easier budget and resource discussions
• Proof for regulators of the robustness of your program
• Agreed-upon progress metrics and a format to report-out
• Robust prioritization of issues (and how to easily avoid fire drills)
• Effective use of resources
• Comfort in the identification of issues

How can companies achieve these benefits? To secure the full benefits of a robust risk assessment, the mindset must be one of establishing a continuous feedback loop. Too many companies view a risk assessment as a document rather than a process.

The first requirement is to involve the business in the process: That's where the feedback comes from. This leads to the first concrete benefit to an effective risk assessment: business buy-in. A risk assessment based on data provided by the business is one that the business will understand and accept. Data-based risk assessments also avoid a compliance officer's confirmation bias—“I know what our risks are”—and gives comfort that all risks have been identified. Because one thing I've found: In any set of data, there's always a surprise. 

An assessment that doesn't include the business will always be suspect in the business's eyes. The business will resist. That resistance will be especially strong when suggesting remediation that costs money. Anything you try to do will be labeled unrealistic, unwieldy, too disruptive and too expensive. And then, I'm afraid, the business will get negative.

The structure of a robust risk assessment leads to some of the other benefits. The risk assessment has several key sections: business activities that bring risk, what type of risk (geographic, industry, third-party, etc.), current mitigating controls, planned mitigating controls and target dates. It has elements of a project plan.

Once the business buys into that project plan, you've just won half the battle. Because buying into the plan means buying into the commitment of resources—budget and people—to accomplish that plan. Even the arguments you'll be having are better ones. You'll argue with the business about resource allocation versus return on investment and which planned mitigation enhancements will have the most impact. You'll be forced to prioritize, think through and focus your efforts. All this will help you improve your program. And as my old boss used to say, it's the right conversation to be having. There's even a term for these kinds of arguments: engagement.

Once you have agreement about the plan and the target dates, you also have a natural reporting-out format. You have a plan; you can track progress against that plan. If you fall behind schedule, you can reprioritize, explain it or renew the discussion around what new resources could achieve.

Next, I knew of a place once where the compliance people felt they were always working on “fire drills”—something happens and requires an immediate response, and then everything else gets put on hold to work on this new thing. So how can a program stop confusing the “important” with the “urgent”? Through risk assessment. When you encounter a new problem, you now have a mechanism to examine that problem in context.

From a regulatory perspective, these kinds of business-based decisions—decisions to prioritize addressing one defined risk over another—are rarely, if ever, questioned.

Imagine having this discussion with regulators: “Look, we caught that issue, and we discussed it. We looked at our entire universe of risk and decided that we needed to address it, but we have four issues that are more pressing, so it's now on our risk map as risk number five. We have a plan in place to address that risk, and we've already decided, alongside the business, what resources—budget and people—we will allocate to it. We've agreed with the business on delivery dates. For previously identified risks, by the way, we're 12 percent ahead of schedule. The business is fully behind this effort, and is integral to our continued risk identification and mitigation efforts.”

Now that's a conversation I'd like to have.