In addition to capturing compliance regulations and laws in an organizations compliance program, the organization needs to understand the nature and impact of the risks being faced in not only their organization and industry, but the intersecting industries as well. This solid and comprehensive understanding will afford an organization to better design their compliance and risk management programs and develop controls to mitigate risks.

 Use available resources efficiently and effectively to monitor, minimize, or control the probability and/or impact of the risks