Risk-based compliance framework design