Which risk category describes the probability and consequences of failing to comply with laws or ethical standards?

• A. Audit
• B. Compliance risk
• C. Consequence
• D. Control

Answer: (B)

Compliance risk describes the chance that an organization will fail to meet laws, regulations, or ethical standards, and the potential outcomes if that happens. It captures both how likely noncompliance is and how severe the consequences can be, such as fines, penalties, legal action, or reputational damage. That combination is what makes it the appropriate risk category for issues tied to legal and ethical adherence.

Audits are activities that assess controls and provide assurance, not a risk category. Consequence refers to the impact or severity of an risk event, not the overall risk category itself. Controls are safeguards used to reduce risk, not the risk itself.