TL;DR
- Compliance risk assessment software scores each legal obligation by the likelihood of a breach and the impact if it happens, then ranks compliance work by that score.
- Under Indian law the impact input is set largely by the penalty provision: imprisonment, a monetary penalty, or licence suspension.
- The output is a prioritised task list for owners and a risk report the Board can rely on.
Quick Answer: Compliance risk assessment software scores each legal obligation by the likelihood of a breach and its impact, then ranks compliance work by that score. Under Indian law the penalty provision sets most of the impact. LexComply's Compliance Criticality Matrix grades each compliance high, medium or low by penalty and imprisonment risk.
Not every compliance carries the same exposure. A late professional tax return and a lapsed factory licence are both breaches, but only one can stop a plant. Compliance risk assessment software, unlike a general governance, risk and compliance (GRC) suite, makes that difference explicit at the level of each obligation, so owners, managers and the Board act on the obligations that matter most first.
Compliance risk assessment at a glance
| Input or output | What it is | Example |
|---|---|---|
| Obligation | One duty under one law, for one entity and site | Annual return under a labour Code |
| Likelihood | Chance of a breach | Past delays, complexity, owner workload |
| Impact | Consequence of a breach | Imprisonment, penalty amount, licence loss |
| Risk score | Likelihood combined with impact | High, medium or low |
| Prioritised tasks | Work ordered by score and due date | High-risk items first, with escalation |
| Board report | Exposure by entity, law and owner | Open high-risk items this quarter |
How Does Compliance Risk Assessment Software Differ From Global GRC Software?
Compliance risk software works from a library of specific legal obligations. Global GRC suites usually work from a framework of controls and risks that the user populates. For a company operating in India, the difference decides how much of the content the buyer must build.
| Question | Global GRC suite | India compliance risk software |
|---|---|---|
| Where obligations come from | Entered by the user or a consultant | Pre-built library of Central, State and local laws |
| Unit of assessment | Control in a framework | Individual legal obligation |
| Impact input | User-defined scale | Penalty provision in the statute |
| Legal updates | Usually outside the tool | Amendments pushed into affected obligations |
| State and municipal law | Often absent | Mapped by site |
Many multinationals use both. The GRC suite handles group-wide controls, and the India compliance tool feeds it obligation-level status. The guide to GRC platforms for global enterprises covers the group-level choice.
How Is a Compliance Obligation Scored for Risk?
By combining a likelihood rating with an impact rating, usually on a three-level or five-level scale. A simple matrix multiplies the two.
| Likelihood / impact | Low impact | Medium impact | High impact |
|---|---|---|---|
| High likelihood | Medium | High | High |
| Medium likelihood | Low | Medium | High |
| Low likelihood | Low | Low | Medium |
Should the Score Be Fixed or Recalculated?
Recalculated. Impact changes when the law changes, and likelihood changes when an owner misses dates or a site grows. A score set once at implementation goes stale within a year.
Which Likelihood and Impact Inputs Apply Under Indian Law?
Impact comes mainly from the statute. Likelihood comes from the company's own history and circumstances.
Which Impact Inputs Does the Statute Set?
The penalty provision sets most of the impact rating. Four questions decide it.
- Is imprisonment possible? Some offences still carry imprisonment, which places them in the highest band.
- What is the monetary exposure? A fixed fine, a daily penalty, or a minimum with no ceiling.
- Can a licence be suspended or cancelled? Loss of a licence, such as a factory licence under the Occupational Safety, Health and Working Conditions Code, 2020, can halt operations.
- Who is personally liable? Under the Companies Act, 2013, an "officer who is in default" under section 2(60) can be liable along with the company.
Why Do Decriminalisation Amendments Change the Score?
Because they move offences from imprisonment to monetary penalties. The Jan Vishwas (Amendment of Provisions) Act, 2023 converted many offences across Central Acts into penalties. The Jan Vishwas (Amendment of Provisions) Act, 2026, which received assent on 7 April 2026, continues that work, and its amendments commence on dates notified separately for each amended Act. An obligation scored high for imprisonment risk may belong in a lower band, but only from the date the relevant amendment commences. Each change should be re-scored from the amended text.
Which Likelihood Inputs Should Be Used?
Use evidence from the company's own record. Useful inputs are past delays on the same obligation, the number of sites or entities involved, the complexity of the filing and the owner's open workload. Event-based obligations, triggered by a change such as a new director, score higher because they are easy to miss.
How Should Compliance Tasks Be Prioritised by Risk?
By risk score first and due date second, with escalation rules tied to the score. A high-risk item due in ten days should outrank a low-risk item due tomorrow on the owner's list.
| Risk level | Owner action | Escalation |
|---|---|---|
| High | Act immediately; evidence required on closure | Senior management and Board visibility |
| Medium | Act before the due date | Manager notified if overdue |
| Low | Standard tracking | Included in periodic reports |
Day-to-day tracking of these tasks is covered in the guide to compliance monitoring software.
What Should a Compliance Risk Report for the Board Show?
It should show exposure, not activity. Directors need to see where the company could be penalised, not how many tasks closed.
- Open high-risk obligations, by entity and owner.
- Overdue items, with the penalty exposure for each.
- Trend, comparing this quarter with the last.
- Changes in law that moved obligations between risk bands.
- Exceptions, such as obligations marked not applicable, with reasons.
How Does the Risk Report Support the Board's Report?
It supplies the evidence behind two statutory statements. Section 134(3)(n) of the Companies Act, 2013 requires the Board's report to state how a risk management policy is developed and implemented, including the elements of risk that may threaten the company's existence. A compliance risk report supplies the legal-obligation content of that statement.
The report also supports the directors' statement under section 134(5)(f) that systems to ensure compliance with all applicable laws are adequate and operating effectively. A compliance dashboard gives the same view on demand, and compliance reporting across entities consolidates it for a group.
What Do Multinationals in India Need From the Software?
They need coverage of Central, State and local law, multi-entity reporting and output that feeds the group's own risk framework. A multinational with Indian subsidiaries in several States faces different obligations in each.
- State coverage. Shops, labour welfare and professional tax rules differ by State.
- Sector law. Financial services, food and pharmaceuticals add regulator-specific duties.
- Group reporting. Status by subsidiary, in a form the parent's GRC suite can import.
- Update speed. Notifications must reach the obligation library before the next due date. Automating that flow is covered in the guide to regulatory compliance automation software.
How Does LexComply Grade Compliance Risk?
The compliance management platform grades every compliance in a Compliance Criticality Matrix. For India, LexComply classes as high risk any compliance carrying imprisonment risk or a penalty above ₹50,000. Medium risk covers penalties between ₹10,000 and ₹50,000 and requires management notification within 48 hours. Low risk covers penalties below ₹10,000.
Each compliance is also typed as one-time, due-date based, event based or ongoing, with monetary, operational or imprisonment impact. AI-driven notifications use historical default patterns to route reminders, and dashboards show heat maps and risk exposure by entity and law. To review your obligation library by risk, contact LexComply.
Common Mistakes to Avoid
- Scoring by Act instead of by obligation. One Act can hold both an imprisonment offence and a minor penalty, so each obligation needs its own score.
- Keeping imprisonment scores after decriminalisation. The Jan Vishwas Acts of 2023 and 2026 converted many offences to penalties, so re-score from the amended text once each amendment commences.
- Treating a minimum penalty as a maximum. A provision stating a fine "not less than" a sum has a floor, not a ceiling.
- Ignoring personal liability. An "officer who is in default" under section 2(60) of the Companies Act, 2013 can be liable alongside the company.
- Scoring event-based obligations low. Duties triggered by a change of director or address are missed more often than calendar filings.
Legal Disclaimer
This article is general information on compliance risk assessment in India, current as at the date shown above. It is not legal advice, and the penalty for any breach depends on the provision, its amendments and the facts.