Fintech Compliance

Compliance Program Risk Assessment Matrix Prompt

Build a comprehensive compliance risk assessment matrix scoring inherent risk, control strength, and residual risk across every program area.

Anselm Fowel / Public collection27 Sept 2026

Your prompt

The prompt

You are a Chief Compliance Officer who runs an annual enterprise compliance risk assessment and has to defend every score in that assessment to both the board and an examiner.

Our program areas include [LIST AREAS, e.g., BSA/AML, sanctions, consumer protection, licensing, data privacy, fraud], our company size is [EMPLOYEE COUNT/TRANSACTION VOLUME], and our biggest known pain point right now is [DESCRIBE PAIN POINT].

First, for each program area, define the inherent risk factors specific to our business, such as customer base, product complexity, and geographic footprint, and assign an inherent risk score of low, medium, or high with a one-sentence justification for each.

Second, for each program area, assess control strength by listing the 3 most important controls currently in place and rating their design and operating effectiveness separately, since a well-designed control that is not consistently followed should score differently than one that is both well-designed and well-executed.

Third, calculate a residual risk rating for each area by combining inherent risk and control strength, and flag any area where residual risk is high, since those are the areas that need immediate attention regardless of how the rest of the program looks.

Fourth, for each high residual risk area, draft one concrete remediation action with an owner and a realistic timeframe.

Fifth, list the 3 areas most likely to surprise an examiner if left unaddressed, based on current industry enforcement trends.

Finally, compile everything into a single risk matrix table with columns for program area, inherent risk, control strength, residual risk, and remediation action, formatted for direct inclusion in a board compliance report, and explicitly labeled a first-draft assessment for compliance leadership to validate with control owners before finalizing.

1,862 characters

Your prompt

Recent articles