Compliance Risk Assessment Matrix - California

COMPLIANCE RISK ASSESSMENT MATRIX -- CALIFORNIA

Company Name: [________________________________]
Assessment Period: [__/__/____] through [__/__/____]
Assessment Owner: [________________________________] (Chief Compliance Officer)
Approved By: [________________________________] (General Counsel / Audit Committee)
Document Version: [____]

TABLE OF CONTENTS

1. Executive Summary
2. Purpose and Objectives
3. Scope and Applicability
4. Regulatory Framework
5. Methodology Overview
6. Risk Taxonomy
7. Scoring Rubric
8. Roles and Responsibilities
9. Data Sources and Inputs
10. California-Specific Risk Categories
11. Risk Assessment Matrix
12. Heat Map and Prioritization
13. Remediation Planning
14. Deliverables and Outputs
15. Review Cadence and Triggers
16. Governance and Oversight
17. Appendix A: Definitions
18. Appendix B: Detailed Scoring Criteria
19. Appendix C: California Regulatory Risk Inventory
20. Sources and References

1. EXECUTIVE SUMMARY

This Compliance Risk Assessment Matrix ("Matrix") provides a structured framework for identifying, assessing, and prioritizing compliance risks facing [________________________________] ("Company") with respect to operations in or connected to the State of California. The Matrix aligns with the DOJ Evaluation of Corporate Compliance Programs, the COSO ERM Framework, and the U.S. Sentencing Guidelines Section 8B2.1 requirements for effective compliance and ethics programs.

Key Findings Summary (to be completed after assessment):

2. PURPOSE AND OBJECTIVES

This Matrix serves to:

• Identify and catalog compliance risks across all business functions operating in California
• Assess inherent risk levels based on likelihood and impact
• Evaluate the effectiveness of existing controls
• Calculate residual risk after controls
• Prioritize remediation efforts based on risk severity and velocity
• Satisfy regulatory expectations for periodic risk assessment under DOJ guidance and USSG 8B2.1
• Inform the Board/Audit Committee of the compliance risk profile

3. SCOPE AND APPLICABILITY

This assessment covers:

☐ All business units, departments, and functions with California operations or California-resident customers/employees
☐ Compliance with federal laws applicable to California operations
☐ Compliance with California-specific statutes and regulations
☐ Third-party and vendor compliance risks
☐ Emerging risks (technology, regulatory changes, market dynamics)

4. REGULATORY FRAMEWORK

4.1 Federal Standards

• U.S. Sentencing Guidelines 8B2.1: Requires organizations to periodically assess the risk of criminal conduct and take appropriate steps to design, implement, or modify compliance programs to reduce that risk. Seven minimum elements of an effective compliance program must be addressed.
• DOJ Evaluation of Corporate Compliance Programs (September 2024 Update): Prosecutors evaluate whether the compliance program is well-designed, adequately resourced and empowered, and works in practice. Key focus areas include risk assessment, policies and procedures, training, confidential reporting, investigation, third-party management, and continuous improvement.
• Sarbanes-Oxley Act Section 404: Requires management assessment of internal controls over financial reporting (ICFR) for public companies, using a recognized framework (typically COSO 2013).
• COSO ERM Framework (2017): Enterprise Risk Management -- Integrating with Strategy and Performance. Five components: Governance and Culture, Strategy and Objective-Setting, Performance, Review and Revision, Information, Communication, and Reporting.

4.2 California-Specific Requirements

• CCPA/CPRA (Cal. Civ. Code 1798.100 et seq.): Comprehensive consumer privacy law requiring data mapping, privacy impact assessments, consumer rights responses (access, deletion, correction, opt-out), and vendor management. Enforced by the California Privacy Protection Agency (CPPA). Penalties up to $2,500 per violation; $7,500 per intentional violation or violation involving a minor.
• Cal. Bus. & Prof. Code 17200 (UCL): Prohibits unfair, unlawful, and fraudulent business practices. Broad standing provisions; restitution and injunctive relief available.
• FEHA (Cal. Gov. Code 12940 et seq.): Prohibits employment discrimination, harassment, and retaliation. Mandatory sexual harassment prevention training (Cal. Gov. Code 12950.1). Employers with 5+ employees must provide training within six months of hire and every two years.
• Cal. Civ. Code 1798.82 (Data Breach Notification): Requires notification to affected individuals and, if 500+ California residents are affected, to the California Attorney General.
• Cal. Lab. Code 1102.5: Whistleblower protections for employees reporting violations.

5. METHODOLOGY OVERVIEW

5.1 Assessment Approach

The assessment follows a four-phase approach:

Phase 1 -- Risk Identification: Catalog all compliance obligations through regulatory inventories, incident data, audit findings, and stakeholder interviews.

Phase 2 -- Risk Assessment: Evaluate each risk for inherent likelihood and impact; assess control effectiveness; calculate residual risk.

Phase 3 -- Prioritization: Rank risks by residual score; identify trends; flag emerging risks.

Phase 4 -- Remediation Planning: Develop action plans for high and critical risks with owners, deadlines, and success metrics.

5.2 Assessment Cycle

• Full Assessment: Annually (Q1 of each fiscal year)
• Interim Updates: Triggered by material events (see Section 15)
• Continuous Monitoring: Key Risk Indicators (KRIs) tracked monthly/quarterly

6. RISK TAXONOMY

6.1 Primary Risk Categories

6.2 Cross-Cutting Risks

☐ Supply chain and third-party compliance
☐ AI/ML governance and automated decision-making (Cal. Civ. Code 1798.185(a)(16))
☐ Recordkeeping and document retention
☐ Model risk (for financial institutions)
☐ Fraud and abuse
☐ ESG and sustainability compliance

7. SCORING RUBRIC

7.1 Likelihood Scale (1-5)

7.2 Impact Scale (1-5)

7.3 Control Effectiveness Scale (1-5)

7.4 Residual Risk Calculation

Inherent Risk Score = Likelihood x Impact (range: 1-25)

Residual Risk Score = Inherent Risk Score adjusted by Control Effectiveness:

7.5 Risk Rating Thresholds

8. ROLES AND RESPONSIBILITIES

9. DATA SOURCES AND INPUTS

☐ Incident reports, complaints, and hotline data
☐ Regulatory examinations, inquiries, and enforcement actions
☐ Internal and external audit findings
☐ Product/service changes and new market entries
☐ Vendor onboarding assessments and due diligence reports
☐ Key Risk Indicators (KRIs) and metrics dashboards
☐ Loss events and litigation history
☐ Industry peer enforcement actions and regulatory trends
☐ Employee surveys and exit interview data
☐ California-specific regulatory updates (CPPA rulemaking, CRD guidance, AG enforcement)

10. CALIFORNIA-SPECIFIC RISK CATEGORIES

10.1 CCPA/CPRA Compliance Risks

10.2 Employment and EEO Risks (California-Specific)

10.3 Consumer Protection Risks

11. RISK ASSESSMENT MATRIX

11.1 Sample Assessment Entries

Add additional rows for each identified risk. Expand to cover all risk categories in Section 6.

12. HEAT MAP AND PRIORITIZATION

12.1 Risk Heat Map

IMPACT
  5 |  5   10  [15] [20] [25]
  4 |  4    8  [12] [16] [20]
  3 |  3    6    9  [12] [15]
  2 |  2    4    6    8   10
  1 |  1    2    3    4    5
    +----------------------------
       1    2    3    4    5
                LIKELIHOOD

[  ] = Critical/High risk zone requiring immediate attention

12.2 Top Risks (Ranked by Residual Score)

13. REMEDIATION PLANNING

For each High or Critical residual risk, complete the following:

14. DELIVERABLES AND OUTPUTS

☐ Completed Risk Assessment Matrix with all identified risks scored
☐ Heat map visualization
☐ Top risks list with executive summary
☐ Remediation plans for High and Critical risks with owners and deadlines
☐ Testing plan aligned to risk priorities
☐ Board/Audit Committee summary presentation
☐ Change log documenting assumptions and scoring decisions
☐ KRI dashboard for ongoing monitoring

15. REVIEW CADENCE AND TRIGGERS

15.1 Scheduled Reviews

• Annual Full Assessment: Q1 of each fiscal year
• Quarterly Updates: Review KRIs and update risk scores as needed
• Board Reporting: Semi-annual compliance risk report to Audit Committee

15.2 Interim Update Triggers

☐ Receipt of regulatory inquiry, subpoena, or examination notice
☐ Material data breach or security incident
☐ New California legislation or CPPA rulemaking affecting the Company
☐ New product launch, market entry, or significant business change
☐ Merger, acquisition, or material corporate transaction
☐ Material control failure or audit finding
☐ Significant enforcement action against industry peer
☐ Whistleblower report or litigation filing raising systemic compliance concerns

16. GOVERNANCE AND OVERSIGHT

• Assessment Owner: Chief Compliance Officer
• Review Authority: General Counsel and Audit Committee
• Approval: Board of Directors (or designated committee)
• Distribution: Executive Leadership Team, Audit Committee, relevant domain owners
• Confidentiality: This document is confidential and may be subject to attorney-client privilege and work product protection. Distribution must be approved by General Counsel.

APPENDIX A: DEFINITIONS

• Inherent Risk: The level of risk before considering the effectiveness of any controls
• Control Effectiveness: The degree to which controls mitigate the identified risk
• Residual Risk: The level of risk remaining after accounting for control effectiveness
• Key Risk Indicator (KRI): A quantitative metric used to monitor changes in risk levels over time
• Risk Appetite: The level and type of risk the organization is willing to accept in pursuit of its objectives
• Risk Velocity: The speed at which a risk event could impact the organization once it materializes

APPENDIX B: DETAILED SCORING CRITERIA

(Expand the scoring criteria in Section 7 with industry-specific examples and calibration guidance for each risk category.)

APPENDIX C: CALIFORNIA REGULATORY RISK INVENTORY

SOURCES AND REFERENCES

• U.S. Sentencing Guidelines 8B2.1 -- https://guidelines.ussc.gov/
• DOJ Evaluation of Corporate Compliance Programs (Sept. 2024) -- https://www.justice.gov/criminal/criminal-fraud/page/file/937501
• COSO Internal Control Framework (2013) -- https://www.coso.org/
• COSO ERM Framework (2017) -- https://www.coso.org/erm-framework
• Sarbanes-Oxley Act Section 404, 15 U.S.C. 7262
• CCPA/CPRA, Cal. Civ. Code 1798.100 et seq.
• California Privacy Protection Agency -- https://cppa.ca.gov/
• Cal. Bus. & Prof. Code 17200 (Unfair Competition Law)
• FEHA, Cal. Gov. Code 12940 et seq.
• Cal. Lab. Code 1102.5 (Whistleblower Protections)
• Cal. Civ. Code 1798.82 (Data Breach Notification)

This document is a template provided for informational purposes only and does not constitute legal advice. It must be reviewed and customized by a qualified attorney licensed in California before implementation.