Compliance Risk Assessment Matrix - Texas

COMPLIANCE RISK ASSESSMENT MATRIX -- TEXAS

Company Name: [________________________________]
Assessment Period: [__/__/____] through [__/__/____]
Assessment Owner: [________________________________] (Chief Compliance Officer)
Approved By: [________________________________] (General Counsel / Audit Committee)
Document Version: [____]

TABLE OF CONTENTS

1. Executive Summary
2. Purpose and Objectives
3. Scope and Applicability
4. Regulatory Framework
5. Methodology Overview
6. Risk Taxonomy
7. Scoring Rubric
8. Roles and Responsibilities
9. Data Sources and Inputs
10. Texas-Specific Risk Categories
11. Risk Assessment Matrix
12. Heat Map and Prioritization
13. Remediation Planning
14. Deliverables and Outputs
15. Review Cadence and Triggers
16. Governance and Oversight
17. Appendix A: Definitions
18. Appendix B: Texas Regulatory Risk Inventory
19. Sources and References

1. EXECUTIVE SUMMARY

This Compliance Risk Assessment Matrix ("Matrix") provides a structured framework for identifying, assessing, and prioritizing compliance risks facing [________________________________] ("Company") with respect to operations in or connected to the State of Texas. The Matrix aligns with the DOJ Evaluation of Corporate Compliance Programs, the COSO ERM Framework, and USSG 8B2.1.

Key Findings Summary:

2. PURPOSE AND OBJECTIVES

This Matrix serves to:

• Identify and catalog compliance risks across all business functions operating in Texas
• Assess inherent risk levels based on likelihood and impact
• Evaluate control effectiveness and calculate residual risk
• Prioritize remediation by severity and velocity
• Satisfy DOJ and USSG 8B2.1 expectations for periodic risk assessment
• Address Texas-specific regulatory requirements including the TDPSA and DTPA
• Inform the Board/Audit Committee of the compliance risk profile

3. SCOPE AND APPLICABILITY

☐ All business units with Texas operations or Texas-resident customers/employees
☐ Federal laws applicable to Texas operations
☐ Texas-specific statutes and regulations
☐ Third-party and vendor compliance risks
☐ Emerging risks (technology, regulatory changes, market dynamics)

4. REGULATORY FRAMEWORK

4.1 Federal Standards

• U.S. Sentencing Guidelines 8B2.1: Periodic risk assessment; seven minimum compliance program elements.
• DOJ Evaluation of Corporate Compliance Programs (September 2024 Update): Program design, resourcing, and effectiveness evaluation.
• SOX Section 404 / COSO 2013: ICFR for public companies.
• COSO ERM Framework (2017): Enterprise risk management integration with strategy.

4.2 Texas State Law

• Texas Data Privacy and Security Act (TDPSA) (Tex. Bus. & Com. Code Ch. 541): Effective July 1, 2024. Applies to persons conducting business in Texas that process personal data of Texas consumers. Grants consumer rights: access, correction, deletion, portability, and opt-out of targeted advertising, sale, and profiling. Requires data protection assessments for high-risk processing. Small business exemption (SBA definition) except for sale of sensitive data. TX AG exclusive enforcement; 30-day cure period. Global opt-out mechanism recognition effective January 1, 2025.
• Tex. Bus. & Com. Code 521.053 (Data Breach Notification): Requires notice to affected individuals without unreasonable delay and no later than 60 days after breach determination. If at least 250 Texas residents are involved, electronic AG notice is due as soon as practicable and no later than 30 days. Nationwide-CRA notice applies only if notice is required at one time to more than 10,000 persons.
• Texas Deceptive Trade Practices Act (DTPA) (Tex. Bus. & Com. Code 17.46): Prohibits false, misleading, or deceptive acts or practices in trade or commerce. Laundry list of specific prohibited acts. Private right of action for consumers with treble damages for knowing violations. TX AG enforcement authority.
• Texas Commission on Human Rights Act (TCHRA) (Tex. Lab. Code Ch. 21): Prohibits employment discrimination based on race, color, disability, religion, sex, national origin, age, or retaliation. Administered by the Texas Workforce Commission Civil Rights Division (TWC-CRD). Compensatory damages capped by employer size: $50K (15-100 employees), $100K (101-200), $200K (201-500), $300K (501+).
• Texas Whistleblower Act (Tex. Gov't Code Ch. 554): Protects public employees from retaliation for good-faith reporting of law violations. Private sector employees may have protections under Sabine Pilot doctrine (Texas common law prohibiting discharge for refusal to commit an illegal act).
• Tex. Penal Code Ch. 36 (Bribery and Corrupt Influence): Criminal penalties for bribery and improper gifts to public servants.
• Texas Ethics Commission (Tex. Gov't Code Ch. 572): Standards of conduct for state officers and employees.

5. METHODOLOGY OVERVIEW

Phase 1 -- Risk Identification: Catalog compliance obligations.
Phase 2 -- Risk Assessment: Evaluate inherent risk and control effectiveness.
Phase 3 -- Prioritization: Rank by residual score; identify trends.
Phase 4 -- Remediation Planning: Action plans for high/critical risks.

• Full Assessment: Annually (Q1)
• Interim Updates: Material events (Section 15)
• Continuous Monitoring: KRIs monthly/quarterly

6. RISK TAXONOMY

7. SCORING RUBRIC

7.1 Likelihood Scale (1-5)

7.2 Impact Scale (1-5)

7.3 Control Effectiveness Scale (1-5)

7.4 Residual Risk Calculation

Inherent Risk = Likelihood x Impact (1-25)

7.5 Risk Ratings

8. ROLES AND RESPONSIBILITIES

9. DATA SOURCES AND INPUTS

☐ Incident reports, complaints, hotline data
☐ Regulatory examinations and enforcement actions (TX AG, TWC-CRD, TCEQ)
☐ Internal and external audit findings
☐ Product/service changes and market entries
☐ Vendor risk assessments
☐ KRIs and dashboards
☐ Loss events and litigation history
☐ Industry peer enforcement actions
☐ Texas-specific regulatory updates (TX AG enforcement, TDPSA rulemaking, Ethics Commission opinions)

10. TEXAS-SPECIFIC RISK CATEGORIES

10.1 Data Privacy and Security Risks

10.2 Consumer Protection Risks

10.3 Employment and EEO Risks

10.4 Anti-Corruption and Ethics Risks

10.5 Energy and Environmental Risks (if applicable)

11. RISK ASSESSMENT MATRIX

Add additional rows for each identified risk.

12. HEAT MAP AND PRIORITIZATION

12.1 Risk Heat Map

IMPACT
  5 |  5   10  [15] [20] [25]
  4 |  4    8  [12] [16] [20]
  3 |  3    6    9  [12] [15]
  2 |  2    4    6    8   10
  1 |  1    2    3    4    5
    +----------------------------
       1    2    3    4    5
                LIKELIHOOD

12.2 Top Risks

13. REMEDIATION PLANNING

14. DELIVERABLES AND OUTPUTS

☐ Completed Risk Assessment Matrix
☐ Heat map visualization
☐ Top risks list with executive summary
☐ Remediation plans for High/Critical risks
☐ Board/Audit Committee summary
☐ KRI dashboard

15. REVIEW CADENCE AND TRIGGERS

• Annual Full Assessment: Q1
• Quarterly KRI Reviews
• Interim Triggers: Regulatory inquiry, data breach, new TX legislation (e.g., TDPSA amendments), M&A, control failure, peer enforcement, whistleblower report, severe weather events (DTPA price gouging provisions under Tex. Bus. & Com. Code 17.46(b)(27))

16. GOVERNANCE AND OVERSIGHT

• Assessment Owner: Chief Compliance Officer
• Review Authority: General Counsel and Audit Committee
• Confidentiality: Subject to attorney-client privilege. Distribution approved by General Counsel.

APPENDIX A: DEFINITIONS

• Inherent Risk: Risk level before controls
• Control Effectiveness: Degree to which controls mitigate risk
• Residual Risk: Risk after controls
• KRI: Key Risk Indicator
• Risk Appetite: Acceptable risk level
• Risk Velocity: Speed of risk materialization

APPENDIX B: TEXAS REGULATORY RISK INVENTORY

SOURCES AND REFERENCES

• U.S. Sentencing Guidelines 8B2.1 -- https://guidelines.ussc.gov/
• DOJ Evaluation of Corporate Compliance Programs (Sept. 2024) -- https://www.justice.gov/criminal/criminal-fraud/page/file/937501
• COSO ERM Framework (2017) -- https://www.coso.org/erm-framework
• Texas Data Privacy and Security Act -- https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/texas-data-privacy-and-security-act
• Tex. Bus. & Com. Code 521.053 (Breach Notification)
• Texas DTPA (Tex. Bus. & Com. Code 17.41 et seq.)
• TCHRA (Tex. Lab. Code Ch. 21)
• Texas Ethics Commission -- https://www.ethics.state.tx.us/
• Tex. Penal Code Ch. 36 (Bribery)
• Texas Whistleblower Act (Tex. Gov't Code Ch. 554)

This document is a template provided for informational purposes only and does not constitute legal advice. It must be reviewed and customized by a qualified attorney licensed in Texas before implementation.