Compliance Risk Assessment Matrix - Florida

COMPLIANCE RISK ASSESSMENT MATRIX -- FLORIDA

Company Name: [________________________________]
Assessment Period: [__/__/____] through [__/__/____]
Assessment Owner: [________________________________] (Chief Compliance Officer)
Approved By: [________________________________] (General Counsel / Audit Committee)
Document Version: [____]

TABLE OF CONTENTS

1. Executive Summary
2. Purpose and Objectives
3. Scope and Applicability
4. Regulatory Framework
5. Methodology Overview
6. Risk Taxonomy
7. Scoring Rubric
8. Roles and Responsibilities
9. Data Sources and Inputs
10. Florida-Specific Risk Categories
11. Risk Assessment Matrix
12. Heat Map and Prioritization
13. Remediation Planning
14. Deliverables and Outputs
15. Review Cadence and Triggers
16. Governance and Oversight
17. Appendix A: Definitions
18. Appendix B: Florida Regulatory Risk Inventory
19. Sources and References

1. EXECUTIVE SUMMARY

This Compliance Risk Assessment Matrix ("Matrix") provides a structured framework for identifying, assessing, and prioritizing compliance risks facing [________________________________] ("Company") with respect to operations in or connected to the State of Florida. The Matrix aligns with the DOJ Evaluation of Corporate Compliance Programs, the COSO ERM Framework, and the U.S. Sentencing Guidelines Section 8B2.1.

Key Findings Summary (to be completed after assessment):

2. PURPOSE AND OBJECTIVES

This Matrix serves to:

• Identify and catalog compliance risks across all business functions operating in Florida
• Assess inherent risk levels based on likelihood and impact
• Evaluate the effectiveness of existing controls
• Calculate residual risk after controls
• Prioritize remediation efforts based on risk severity and velocity
• Satisfy DOJ and USSG 8B2.1 expectations for periodic risk assessment
• Inform the Board/Audit Committee of the compliance risk profile

3. SCOPE AND APPLICABILITY

This assessment covers:

☐ All business units, departments, and functions with Florida operations or Florida-resident customers/employees
☐ Compliance with federal laws applicable to Florida operations
☐ Compliance with Florida-specific statutes and regulations
☐ Third-party and vendor compliance risks
☐ Emerging risks (technology, regulatory changes, market dynamics)

4. REGULATORY FRAMEWORK

4.1 Federal Standards

• U.S. Sentencing Guidelines 8B2.1: Organizations must periodically assess criminal conduct risk and design compliance programs accordingly. Seven minimum elements required.
• DOJ Evaluation of Corporate Compliance Programs (September 2024 Update): Evaluates whether compliance programs are well-designed, adequately resourced, and work in practice.
• Sarbanes-Oxley Act Section 404: ICFR management assessment for public companies using COSO 2013.
• COSO ERM Framework (2017): Five components: Governance and Culture, Strategy and Objective-Setting, Performance, Review and Revision, Information, Communication, and Reporting.

4.2 Florida-Specific Requirements

• Florida Digital Bill of Rights (Fla. Stat. 501.701-501.721): Effective July 1, 2024. Applies to entities conducting business in Florida with annual global revenues exceeding $1 billion and meeting certain data processing thresholds. Grants consumers rights to access, correct, delete, and opt out of targeted advertising and sale of personal data. Enforcement exclusively by the Florida Attorney General.
• Florida Information Protection Act (FIPA) (Fla. Stat. 501.171): Requires notification to individuals of data breaches within 30 days of determination. Notification to the Florida Attorney General required if 500+ individuals affected. Penalties: $1,000/day for first 30 days; $50,000/day thereafter; cap of $500,000 per breach.
• Florida Deceptive and Unfair Trade Practices Act (FDUTPA) (Fla. Stat. 501.201 et seq.): Prohibits unfair or deceptive acts in trade or commerce. AG enforcement and private right of action for actual damages.
• Florida Civil Rights Act (Fla. Stat. 760.01 et seq.): Prohibits employment discrimination based on race, color, religion, sex, pregnancy, national origin, age, handicap, or marital status. Enforced by the Florida Commission on Human Relations (FCHR).
• Florida Whistleblower Act: Public sector (Fla. Stat. 112.3187) and private sector (Fla. Stat. 448.102) protections.

5. METHODOLOGY OVERVIEW

5.1 Assessment Approach

Phase 1 -- Risk Identification: Catalog compliance obligations through regulatory inventories, incident data, audit findings, and stakeholder interviews.

Phase 2 -- Risk Assessment: Evaluate inherent likelihood and impact; assess control effectiveness; calculate residual risk.

Phase 3 -- Prioritization: Rank risks by residual score; identify trends; flag emerging risks.

Phase 4 -- Remediation Planning: Develop action plans for high and critical risks.

5.2 Assessment Cycle

• Full Assessment: Annually (Q1 of each fiscal year)
• Interim Updates: Triggered by material events (see Section 15)
• Continuous Monitoring: KRIs tracked monthly/quarterly

6. RISK TAXONOMY

7. SCORING RUBRIC

7.1 Likelihood Scale (1-5)

7.2 Impact Scale (1-5)

7.3 Control Effectiveness Scale (1-5)

7.4 Residual Risk Calculation

Inherent Risk Score = Likelihood x Impact (range: 1-25)

7.5 Risk Rating Thresholds

8. ROLES AND RESPONSIBILITIES

9. DATA SOURCES AND INPUTS

☐ Incident reports, complaints, and hotline data
☐ Regulatory examinations, inquiries, and enforcement actions
☐ Internal and external audit findings
☐ Product/service changes and new market entries
☐ Vendor onboarding assessments and due diligence
☐ Key Risk Indicators (KRIs) and metrics dashboards
☐ Loss events and litigation history
☐ Industry peer enforcement actions
☐ Employee surveys and exit interview data
☐ Florida-specific regulatory updates (FL AG enforcement, FCHR actions, OFR bulletins)

10. FLORIDA-SPECIFIC RISK CATEGORIES

10.1 Data Privacy and Security Risks

10.2 Consumer Protection Risks

10.3 Employment and EEO Risks

10.4 Insurance and Financial Risks (if applicable)

11. RISK ASSESSMENT MATRIX

Add additional rows for each identified risk.

12. HEAT MAP AND PRIORITIZATION

12.1 Risk Heat Map

IMPACT
  5 |  5   10  [15] [20] [25]
  4 |  4    8  [12] [16] [20]
  3 |  3    6    9  [12] [15]
  2 |  2    4    6    8   10
  1 |  1    2    3    4    5
    +----------------------------
       1    2    3    4    5
                LIKELIHOOD

12.2 Top Risks (Ranked by Residual Score)

13. REMEDIATION PLANNING

For each High or Critical residual risk:

14. DELIVERABLES AND OUTPUTS

☐ Completed Risk Assessment Matrix with all risks scored
☐ Heat map visualization
☐ Top risks list with executive summary
☐ Remediation plans for High and Critical risks
☐ Testing plan aligned to risk priorities
☐ Board/Audit Committee summary presentation
☐ Change log of assumptions and scoring decisions
☐ KRI dashboard for ongoing monitoring

15. REVIEW CADENCE AND TRIGGERS

15.1 Scheduled Reviews

• Annual Full Assessment: Q1 of each fiscal year
• Quarterly Updates: Review KRIs; update risk scores
• Board Reporting: Semi-annual compliance risk report

15.2 Interim Update Triggers

☐ Receipt of regulatory inquiry, subpoena, or examination notice
☐ Material data breach or security incident
☐ New Florida legislation or AG enforcement guidance
☐ New product launch, market entry, or significant business change
☐ Merger, acquisition, or material corporate transaction
☐ Material control failure or audit finding
☐ Significant enforcement action against industry peer
☐ Whistleblower report or litigation raising systemic compliance concerns
☐ Hurricane or natural disaster affecting Florida operations (consider FDUTPA price gouging triggers)

16. GOVERNANCE AND OVERSIGHT

• Assessment Owner: Chief Compliance Officer
• Review Authority: General Counsel and Audit Committee
• Approval: Board of Directors (or designated committee)
• Confidentiality: Confidential; may be subject to attorney-client privilege. Distribution approved by General Counsel.

APPENDIX A: DEFINITIONS

• Inherent Risk: Risk level before considering control effectiveness
• Control Effectiveness: Degree to which controls mitigate the identified risk
• Residual Risk: Risk level remaining after accounting for controls
• Key Risk Indicator (KRI): Quantitative metric monitoring risk changes
• Risk Appetite: Level and type of risk the organization is willing to accept
• Risk Velocity: Speed at which a risk event could impact the organization

APPENDIX B: FLORIDA REGULATORY RISK INVENTORY

SOURCES AND REFERENCES

• U.S. Sentencing Guidelines 8B2.1 -- https://guidelines.ussc.gov/
• DOJ Evaluation of Corporate Compliance Programs (Sept. 2024) -- https://www.justice.gov/criminal/criminal-fraud/page/file/937501
• COSO ERM Framework (2017) -- https://www.coso.org/erm-framework
• Florida Digital Bill of Rights (Fla. Stat. 501.701-501.721)
• Florida Information Protection Act (Fla. Stat. 501.171)
• Florida Deceptive and Unfair Trade Practices Act (Fla. Stat. 501.201 et seq.)
• Florida Civil Rights Act (Fla. Stat. 760.01 et seq.)
• Florida Commission on Ethics -- https://www.ethics.state.fl.us/
• Florida Whistleblower Act (Fla. Stat. 112.3187; 448.102)
• Florida Attorney General Consumer Protection -- https://www.myfloridalegal.com/

This document is a template provided for informational purposes only and does not constitute legal advice. It must be reviewed and customized by a qualified attorney licensed in Florida before implementation.