What Is a Compliance Risk Assessment? Steps, Framework, and Examples

A medical device team submits a 510(k) with a traceability matrix that looks complete on paper. Weeks later, an FDA reviewer picks a random requirement and asks the team to walk through the chain from design input to verification. The chain breaks at the third link because a mid-cycle design change never made it to the test plan. Clearance stalls.

Compliance risk assessments catch gaps like this before a regulator does. They give engineering and quality teams a structured way to spot where products and processes fall short of regulatory obligations, evaluate the consequences, and put controls in place while there’s still time to act.

This guide covers what a compliance risk assessment is, how to conduct one, the frameworks that shape good practice, and what happens when the process breaks down.

What Is a Compliance Risk Assessment?

A compliance risk assessment identifies which regulations apply to your product, flags where you might not be meeting them, and evaluates the consequences. It runs continuously across the product lifecycle. The key distinction is between inherent risk (your exposure before controls) and residual risk (what’s left after controls), and you need to evaluate both individually and in total.

A general risk assessment asks “could this product harm someone?” using methods like ISO 14971 or FMEA. A compliance risk assessment asks “are we meeting our regulatory obligations?” and traces from requirement to gap to consequence. The first produces risk controls. The second produces a list of compliance gaps, remediation plans, and submission evidence.

How to Conduct a Compliance Risk Assessment

The process follows five stages. The goal is a documented risk management plan that connects every regulatory obligation to a control, and every control to evidence that proves it works.

1. Define the Scope and Applicable Regulatory Requirements

If you start with an incomplete scope, you’ll find the gaps later during an audit or submission, which is exactly when you don’t want to find them. Five dimensions define the boundary:

• Product scope: Which devices, product families, or lines are included.
• Process scope: Which development and manufacturing processes apply.
• Lifecycle stage: Design, production, post-market, or all stages.
• Geographic scope: Which regulatory jurisdictions apply, such as FDA, EU MDR, Health Canada, or others.
• Company scope: Which functions, sites, and supply chain tiers are included.

The output is a documented scope statement, a complete list of regulatory obligations, and a traceability matrix that links each requirement to the team responsible for meeting it.

2. Identify Compliance Risks Across Products and Processes

This stage surfaces all the ways compliance could fail. In regulated product development, two categories apply:

• Performance requirement risk: Product safety risk from not meeting performance specs.
• Regulatory compliance risk: Missing documentation, weak process controls, or quality management system gaps that block delivery.

Pulling in people from different teams at this stage prevents the blind spots you get when only one department runs the assessment.

3. Evaluate the Likelihood and Impact of Each Risk

Each identified risk gets scored on two dimensions. Probability measures how likely the gap is to actually happen. Severity measures the impact if it does, from minor documentation issues to warning letters, consent decrees, or pulling the product from the market.

A common mistake is just multiplying severity by probability and drawing a single line between “acceptable” and “unacceptable.” You should define your risk acceptability criteria in the Risk Management Plan before evaluation begins.

4. Prioritize Risks and Assign Controls

Product safety controls follow a priority order. First, try to eliminate the hazard through design choices. Second, add protective measures like safeguards in the device or manufacturing process. Third, if design measures aren’t enough, provide safety information to the user.

Compliance process risks require their own control categories:

• Preventive controls: Procedures, training, design reviews, and checklists that stop the gap from occurring.
• Detective controls: Audits, inspections, and testing activities that catch gaps before they become regulatory findings.
• Corrective controls: CAPA (corrective and preventive action) processes and change management procedures that fix gaps once identified.

When any of these control types is missing, gaps can go unnoticed until an external audit or submission forces them into the open.

5. Monitor, Update, and Review on a Defined Cadence

Compliance risk assessment isn’t a one-time activity. Review frequency should match the risk level. Event-triggered reviews are just as important as scheduled ones. Any design change, new regulatory guidance, adverse event, supplier change, or audit finding should trigger a reassessment.

Compliance Risk Assessment Frameworks

Three frameworks provide the foundation for compliance risk programs in regulated product development.

ISO 31000 as a Baseline for Compliance Risk Programs

You can’t get certified to ISO 31000. It’s a baseline methodology that teams use alongside certifiable standards like ISO 13485, ISO 9001, and ISO 27001. It says risk assessment must happen and defines how to structure the process.

For the actual techniques, teams draw on IEC standards, including FMEA, fault tree analysis, and hazard and operability study (HAZOP). Because ISO 31000 applies to any type of risk in any sector, it works as a reference framework even when your primary certifiable standard is industry-specific.

NIST Risk Management Framework for Product Compliance

The National Institute of Standards and Technology (NIST) Risk Management Framework covers compliance, regulatory, safety, and supply chain risk through seven steps: Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor. These map directly to product development activities.

The Authorize step matters most here. It requires a specific person to sign off on a documented risk decision against a defined risk tolerance. That creates a clear record of who accepted what risk and why.

How IEC 62304, ISO 26262, and DO-178C Classify Risk

Each of these industry-specific standards defines its own risk classification scheme, but none handles risk on its own. All three depend on upstream hazard analysis frameworks.

In IEC 62304 (medical device software), Class C is the highest safety classification and carries the heaviest documentation requirements. ISO 26262’s ASIL levels (automotive safety integrity levels) shape everything downstream, from how you write requirements to how much redundancy your architecture needs. At the strictest end, DO-178C’s DAL A (the highest assurance level for aerospace software) can demand as many as 71 objectives, including full Modified Condition/Decision Coverage, which means testing every logical condition that could independently change a decision outcome in the code.

Compliance Risk Assessment Examples by Industry

Enforcement actions across medical device, automotive, and aerospace show what happens when compliance risk assessments fail in practice.

Medical Device Compliance Risk Assessment

A November 2024 warning letter cited a firm for failing to set up corrective and preventive action (CAPA) procedures under the Code of Federal Regulations (CFR). The firm submitted three written responses but still hadn’t filed the required Reports of Correction or Removal as of October 31, 2024. The FDA declared the devices adulterated and warned that continued failure could lead to seizure, injunction, and civil money penalties.

The main compliance risk here wasn’t the initial violation. It was the firm’s repeated failure to close it out through its CAPA responses.

Automotive Systems Compliance Risk Assessment

In June 2023, a Safety Recall Report filed with the National Highway Traffic Safety Administration (NHTSA) identified a safety defect in a Spare Tire Carrier Assembly. The investigation used production records to figure out which vehicles were affected. That’s a traceability-based approach to risk scoping, and it shows how compliance risk assessment depends on documentation you can actually trace back to its source.

Aerospace and Defense Compliance Risk Assessment

In aerospace, a recurring compliance risk pattern shows up where system safety assessment meets software assurance. If the initial hazard assessment underestimates how severe a failure could be, the software team ends up building to a lower assurance level. They can follow the DO-178C process perfectly and still produce a system that doesn’t meet airworthiness requirements.

This has happened in real investigations. The upstream hazard classification was wrong, so the downstream process was executed correctly at the wrong level. A perfectly followed process can’t compensate for an incorrect starting assumption, and the compliance risk sits in the traceability between hazard analysis, assurance level assignment, and verification evidence.

How Jama Connect Supports Compliance Risk Assessment

Jama Connect® is a requirements management platform built for regulated teams. It connects compliance obligations, design inputs, risk items, and verification evidence in a single system so there’s one place to see how requirements link to controls and controls link to proof.

When an upstream requirement changes, suspect-link flags alert downstream owners to exactly what needs review. That means your compliance baseline stays current without manually checking every connection across scattered spreadsheets and disconnected tools.

Turning Compliance Risk Into Continuous Visibility

The common thread across these frameworks, standards, and enforcement examples is that compliance risk assessment is a living process. Teams that build it into daily engineering work, connecting risk items to requirements and requirements to test evidence, produce audit-ready documentation without scrambling to assemble it the week before an inspection.

That workflow depends on keeping risk management, requirements, and verification linked so you can see changes when they happen. When a requirement changes mid-cycle, downstream tests and risk records need review before the gap reaches an auditor or submission reviewer. Start a free trial of Jama Connect to see how it fits your compliance workflow.

Frequently Asked Questions About Compliance Risk Assessment

What is the difference between a compliance risk assessment and a risk assessment?

It depends on where you are in the program. General risk assessment belongs early in design, as soon as you have enough detail to identify hazards. Compliance risk assessment becomes critical before any regulatory submission or audit because it maps from obligation to evidence, not from hazard to harm. Most regulated product teams run both in parallel. Compliance gaps feed into the risk management file, and risk acceptability decisions help prioritize what to fix first.

How often should a compliance risk assessment be updated?

There’s no single mandatory calendar interval across all frameworks. ICH Q9(R1) guidance ties review frequency to the level of risk. But trigger-based reviews matter more than scheduled ones. Design changes, new regulatory guidance, adverse events, or audit findings should all kick off a reassessment, because compliance risk doesn’t wait for your next planned meeting. Platforms like Jama Connect can flag when upstream changes affect downstream compliance records, making trigger-based reviews easier to manage.

What is the difference between inherent risk and residual risk?

Inherent risk is your exposure before any controls. Residual risk is what’s left after controls are applied. A common gap auditors find is a plan that sets residual risk thresholds for each individual hazard but never sets one for the overall risk picture. ISO 14971 requires both. A product can pass every individual hazard assessment and still fail if no one has formally accepted the total combined risk.

Who should be involved in a compliance risk assessment?

It works best when you involve multiple teams from the start. That typically means quality, engineering, regulatory affairs, production operations, supply chain, legal, and clinical. Executive management defines risk acceptability criteria and holds ultimate accountability. Leaving the assessment to a single team usually creates blind spots that show up later in audits or submissions.