How should a business start a compliance risk map?

A compliance risk map starts by understanding how a business operates, where decisions are made and who authorizes them. It then connects potential failures with controls, owners and evidence. The purpose is to prioritize practical actions. A long list of obligations copied without reference to the actual operation makes it difficult to determine what needs attention first.

Follow decisions through one process

Purchasing, sales, recruitment and interaction with authorities commonly involve several teams. Select a relevant process and follow its stages: who requests an action, evaluates it, approves it, makes payment and checks the outcome. This creates a concrete starting point for the review.

For business integrity, Article 25 of Mexico's General Law of Administrative Responsibilities addresses elements including organization, conduct, controls, reporting and training. This is a specific legal reference, rather than an automatic certification that every business obligation has been satisfied.

Short discussions with the people performing the work can reveal exceptions absent from the manual. Examples include urgent purchases approved outside the usual system or suppliers selected by one person. Such observations allow precise risk questions without assuming misconduct has occurred.

A checklist for a useful first matrix

• Describe the risk event as an observable action, such as approving payment without checking delivery.
• Identify the process, people involved and obligation that requires specialist assessment.
• Assess likelihood and consequences using consistent criteria, recording the assumptions behind the assessment.
• Document the existing control and the evidence that could show whether it operates effectively.
• Assign an owner for follow-up and, where appropriate, someone able to review the result independently.
• Select a proportionate action, an internal implementation target and a method for confirming completion.

Separate existing controls from proposed measures. A written policy that has neither been communicated nor applied is different from a procedure supported by verifiable records. The matrix should make that distinction visible so management does not mistake planned improvements for protection already in place.

Test a control before expanding the program

Consider a business requiring a second approval when appointing suppliers. A review could sample files to determine whether approval preceded engagement, whether the reviewer had adequate information and whether exceptions were explained.

This exercise can establish whether a weakness concerns process design, execution or evidence retention. Those causes call for different responses. Adding another form might increase administration without addressing the underlying problem, particularly if no one has responsibility for checking it.

Management needs a clear account of priority risks, outstanding actions and decisions requiring resources. The method can then extend to other processes. The review cycle should reflect changes in the business and its exposures, with significant incidents feeding back into the assessment rather than remaining in a separate log.

Frequently asked questions

Does a small business need a complex system?

Complexity should follow its activities and risks. A small team can start with clear ownership, verifiable controls and an incident record. Size alone does not determine which obligations apply, so proportional design still requires understanding the business context.

Does a risk map remove company liability?

No. It is a management tool for identifying and addressing risks. The existence and effectiveness of measures must be considered alongside the facts and applicable legal framework.

Next step: begin a compliance discussion with one business process and its main exceptions. A risk map can organize the conversation and help define the specialist review required.