Compliance risk assessment framework