Regulatory compliance risk assessment