{"id":2228,"date":"2026-09-02T13:23:29","date_gmt":"2026-09-02T13:23:29","guid":{"rendered":"https:\/\/www.epw.com\/blog\/?p=2228"},"modified":"2026-09-02T13:23:29","modified_gmt":"2026-09-02T13:23:29","slug":"regulatory-compliance-risks-controls","status":"publish","type":"post","link":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls","title":{"rendered":"Types of Regulatory Compliance Risks and Controls"},"content":{"rendered":"<p><strong>Regulatory compliance risks<\/strong> are the ways an organisation can fail to meet laws, regulatory rules, licence conditions or enforceable standards. The main types normally include regulatory-change, authorisation, conduct, financial-crime, data-protection, health-and-safety, reporting and third-party risks. A useful classification does more than name them: it connects each exposure to an owner, proportionate controls, monitoring and evidence.<\/p>\n<p>This article is for compliance officers, risk managers, internal auditors and operational leaders who need a practical taxonomy for a regulated organisation. It explains eight risk types, the controls that commonly address them and a decision method for avoiding both control gaps and unnecessary bureaucracy.<\/p>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_82_2 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd0808;color:#dd0808\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd0808;color:#dd0808\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 eztoc-toggle-hide-by-default' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls\/#Key_takeaways\" >Key takeaways<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls\/#How_to_classify_regulatory_compliance_risk\" >How to classify regulatory compliance risk<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls\/#Eight_types_of_regulatory_compliance_risks_and_controls\" >Eight types of regulatory compliance risks and controls<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls\/#1_Regulatory-change_risk\" >1. Regulatory-change risk<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls\/#2_Authorisation_and_licensing_risk\" >2. Authorisation and licensing risk<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls\/#3_Conduct_and_customer-protection_risk\" >3. Conduct and customer-protection risk<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls\/#4_Financial-crime_and_integrity_risk\" >4. Financial-crime and integrity risk<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls\/#5_Data-protection_and_cyber-compliance_risk\" >5. Data-protection and cyber-compliance risk<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls\/#6_Health_safety_and_environmental_compliance_risk\" >6. Health, safety and environmental compliance risk<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls\/#7_Reporting_records_and_disclosure_risk\" >7. Reporting, records and disclosure risk<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls\/#8_Third-party_and_supply-chain_compliance_risk\" >8. Third-party and supply-chain compliance risk<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls\/#Preventive_detective_and_corrective_controls\" >Preventive, detective and corrective controls<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls\/#How_to_select_proportionate_compliance_controls\" >How to select proportionate compliance controls<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls\/#Worked_example_onboarding_a_high-risk_distributor\" >Worked example: onboarding a high-risk distributor<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls\/#Common_classification_mistakes\" >Common classification mistakes<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls\/#Developing_practical_compliance_capability\" >Developing practical compliance capability<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls\/#Conclusion\" >Conclusion<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls\/#Sources_and_References\" >Sources and References<\/a><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"Key_takeaways\"><\/span>Key takeaways<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li>Classify compliance risk by the obligation and failure scenario, not merely by department.<\/li>\n<li>Use preventive, detective and corrective controls together for material risks.<\/li>\n<li>Specify what evidence proves each control operated, who reviews it and how often.<\/li>\n<li>Reassess controls when regulations, products, systems, countries or third parties change.<\/li>\n<li>Treat a control as effective only after design and operating performance have been tested.<\/li>\n<\/ul>\n<nav aria-label=\"Table of contents\">\n<strong>Contents<\/strong><\/p>\n<ul>\n<li><a href=\"#classification\">How to classify regulatory compliance risk<\/a><\/li>\n<li><a href=\"#risk-types\">Eight types of compliance risk and controls<\/a><\/li>\n<li><a href=\"#control-layers\">Preventive, detective and corrective controls<\/a><\/li>\n<li><a href=\"#selection\">How to select proportionate controls<\/a><\/li>\n<li><a href=\"#example\">Worked example<\/a><\/li>\n<li><a href=\"#training\">Developing practical compliance capability<\/a><\/li>\n<\/ul>\n<\/nav>\n<h2 id=\"classification\"><span class=\"ez-toc-section\" id=\"How_to_classify_regulatory_compliance_risk\"><\/span>How to classify regulatory compliance risk<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Start with an obligation inventory: the laws, rules, permits, contractual regulatory commitments and supervisory expectations that apply to the organisation. Then describe the event that would constitute failure, the affected process, the possible consequence and the evidence a regulator or auditor would expect to see.<\/p>\n<p>The classification should remain useful across functions. For example, a failure to screen a new distributor may be recorded by procurement, but the underlying exposure can include anti-bribery, sanctions, fraud, data-protection and licence risks. The <a href=\"https:\/\/www.justice.gov\/criminal\/criminal-fraud\/page\/file\/937501\/dl?inline=\">US Department of Justice\u2019s 2024 compliance-program guidance<\/a> asks whether a company\u2019s risk assessment is subject to periodic review, whether resources follow the risk profile and whether lessons from misconduct are incorporated. This supports a dynamic, risk-based register rather than a static list.<\/p>\n<p>Regulated organisations should also separate <em>inherent risk<\/em> from <em>residual risk<\/em>. Inherent risk is the exposure before controls; residual risk is what remains after considering control design and performance. This distinction prevents a strong policy document from being mistaken for proof that the underlying risk is low.<\/p>\n<h2 id=\"risk-types\"><span class=\"ez-toc-section\" id=\"Eight_types_of_regulatory_compliance_risks_and_controls\"><\/span>Eight types of regulatory compliance risks and controls<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<table>\n<thead>\n<tr>\n<th>Risk type<\/th>\n<th>Typical failure<\/th>\n<th>Example controls<\/th>\n<th>Useful evidence<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>1. Regulatory change<\/td>\n<td>A new or amended requirement is missed or implemented late<\/td>\n<td>Horizon scanning, obligation register, change-impact assessment<\/td>\n<td>Regulatory alerts, mapped actions, approvals and closure records<\/td>\n<\/tr>\n<tr>\n<td>2. Authorisation and licensing<\/td>\n<td>The organisation operates outside permissions or breaches licence conditions<\/td>\n<td>Licence register, permission checks, renewal calendar, product approval<\/td>\n<td>Current licences, attestations, committee minutes and renewal submissions<\/td>\n<\/tr>\n<tr>\n<td>3. Conduct and customer protection<\/td>\n<td>Products, communications or decisions create unfair customer outcomes<\/td>\n<td>Product governance, disclosure review, complaints analysis, conduct monitoring<\/td>\n<td>Approval files, customer testing, complaint trends and remediation logs<\/td>\n<\/tr>\n<tr>\n<td>4. Financial crime and integrity<\/td>\n<td>Bribery, fraud, money laundering, sanctions or conflicts are not prevented or detected<\/td>\n<td>Due diligence, screening, approval limits, transaction monitoring, speak-up channels<\/td>\n<td>Screening results, investigation files, training records and disciplinary outcomes<\/td>\n<\/tr>\n<tr>\n<td>5. Data protection and cyber compliance<\/td>\n<td>Personal or regulated data is collected, used, retained or secured unlawfully<\/td>\n<td>Data inventory, access controls, impact assessments, retention and breach response<\/td>\n<td>Processing records, access reviews, test results and incident decisions<\/td>\n<\/tr>\n<tr>\n<td>6. Health, safety and environmental compliance<\/td>\n<td>Operations breach safety, environmental or permit requirements<\/td>\n<td>Permit-to-work, inspections, competence checks, monitoring and incident escalation<\/td>\n<td>Inspection logs, permits, calibration records and corrective actions<\/td>\n<\/tr>\n<tr>\n<td>7. Reporting, records and disclosure<\/td>\n<td>Regulatory returns, financial records or mandatory disclosures are inaccurate or late<\/td>\n<td>Data ownership, reconciliations, maker-checker review, submission calendar<\/td>\n<td>Source-to-report lineage, sign-offs, exception reports and submission receipts<\/td>\n<\/tr>\n<tr>\n<td>8. Third-party and supply-chain compliance<\/td>\n<td>An agent, supplier or outsourced provider causes or conceals non-compliance<\/td>\n<td>Risk-tiering, due diligence, clauses, monitoring, audit rights and exit triggers<\/td>\n<td>Due-diligence files, contracts, monitoring results and remediation decisions<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<figure id=\"attachment_2307\" aria-describedby=\"caption-attachment-2307\" style=\"width:100%\"><img decoding=\"async\" src=\"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/02132233\/regulatory-compliance-risk-classification-matrix.webp\" alt=\"Matrix of eight regulatory compliance risk types with typical controls and evidence\" width=\"1200\" style=\"max-width:100%;height:auto\" \/><figcaption id=\"caption-attachment-2307\">A practical classification matrix linking regulatory exposure to control evidence.<\/figcaption><\/figure>\n<h3><span class=\"ez-toc-section\" id=\"1_Regulatory-change_risk\"><\/span>1. Regulatory-change risk<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Requirements can change through legislation, regulator rules, guidance, licence variations, enforcement outcomes or new supervisory priorities. The risk is not only failing to notice a change; it also includes poor interpretation, unclear ownership and incomplete operational implementation.<\/p>\n<p>A strong control chain records the source, effective date, affected entities and processes, accountable owner, required actions and implementation evidence. High-impact changes should receive legal or specialist interpretation and independent challenge before closure.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"2_Authorisation_and_licensing_risk\"><\/span>2. Authorisation and licensing risk<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>This risk arises when an organisation, employee, branch, product or service operates without the correct permission or outside imposed conditions. It can also arise from missed renewals, unreported changes or activities performed in the wrong legal entity.<\/p>\n<p>Controls should combine a central licence register with transaction-level or product-level checks. Renewal reminders alone are insufficient if staff can still launch an activity that exceeds the organisation\u2019s permissions.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"3_Conduct_and_customer-protection_risk\"><\/span>3. Conduct and customer-protection risk<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Conduct risk concerns how decisions affect customers, markets and other stakeholders. Common failures include unsuitable products, misleading communications, biased decisions, poor treatment of vulnerable customers, unmanaged conflicts and ineffective complaints handling.<\/p>\n<p>Controls should begin during product or service design and continue through distribution, customer communication, outcome monitoring and remediation. Management information must show outcomes, not only activity volumes.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"4_Financial-crime_and_integrity_risk\"><\/span>4. Financial-crime and integrity risk<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>This category includes bribery, corruption, fraud, money laundering, terrorist financing, sanctions breaches, market abuse and conflicts of interest. The risk profile depends on geography, customers, payment methods, government touchpoints, intermediaries and transaction patterns.<\/p>\n<p>The <a href=\"https:\/\/legalinstruments.oecd.org\/en\/instruments\/oecd-legal-0378\">OECD Anti-Bribery Recommendation and its Good Practice Guidance<\/a> emphasise risk-based internal controls, ethics and compliance measures. Relevant controls include third-party due diligence, segregation of duties, approval thresholds, screening, monitoring, confidential reporting and proportionate discipline.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"5_Data-protection_and_cyber-compliance_risk\"><\/span>5. Data-protection and cyber-compliance risk<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Data risk spans lawful collection, purpose limitation, transparency, security, retention, individual rights, international transfer and breach response. Ownership must therefore extend beyond information technology to product, operations, legal, procurement and records-management teams.<\/p>\n<p>The UK Information Commissioner\u2019s Office states that accountability requires appropriate technical and organisational measures and evidence that compliance steps were taken. Its <a href=\"https:\/\/ico.org.uk\/for-organisations\/advice-and-services\/audits\/data-protection-audit-framework\/\">data-protection audit framework<\/a> offers practical control measures for assessing this evidence. Security controls can also be mapped against the official <a href=\"https:\/\/csrc.nist.gov\/pubs\/sp\/800\/53\/r5\/final\">NIST SP 800-53 control catalogue<\/a>, tailored to the organisation\u2019s legal and operational context.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"6_Health_safety_and_environmental_compliance_risk\"><\/span>6. Health, safety and environmental compliance risk<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>These risks arise where people, assets, communities or the environment may be harmed and where permits or statutory duties apply. Controls must be embedded in operational work: competence, maintenance, permits, inspections, exposure monitoring, emergency response and stop-work escalation.<\/p>\n<p>Evidence quality is important. A signed checklist is weak if the inspection was superficial, the measuring instrument was not calibrated or overdue corrective actions were tolerated.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"7_Reporting_records_and_disclosure_risk\"><\/span>7. Reporting, records and disclosure risk<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Regulators often depend on accurate and timely returns, notifications and records. Failures may result from ambiguous data definitions, manual manipulation, broken interfaces, weak reconciliations or unclear sign-off responsibility.<\/p>\n<p>Effective controls trace data from source system to submitted figure, apply validation and reconciliation, document adjustments and require accountable review. Retention rules should preserve both the final submission and the evidence used to support it.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"8_Third-party_and_supply-chain_compliance_risk\"><\/span>8. Third-party and supply-chain compliance risk<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Outsourcing a process does not necessarily transfer the organisation\u2019s regulatory accountability. Agents, distributors, suppliers, contractors and cloud providers may introduce bribery, sanctions, privacy, safety, labour, resilience and reporting risks.<\/p>\n<p>Risk-tier third parties before onboarding, apply due diligence proportionate to exposure, include enforceable control and notification clauses, monitor performance, and define escalation and exit triggers. EPW\u2019s overview of <a href=\"https:\/\/www.epw.com\/blog\/courses\/why-is-third-party-risk-management-so-important\">why third-party risk management matters<\/a> provides broader context for this lifecycle.<\/p>\n<h2 id=\"control-layers\"><span class=\"ez-toc-section\" id=\"Preventive_detective_and_corrective_controls\"><\/span>Preventive, detective and corrective controls<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>A mature programme does not rely on a single control type. It creates layers:<\/p>\n<ul>\n<li><strong>Preventive controls<\/strong> reduce the chance of failure. Examples include restricted system access, approval thresholds, mandatory due diligence and automated validation.<\/li>\n<li><strong>Detective controls<\/strong> identify failure or weakening performance. Examples include reconciliations, exception reports, surveillance, quality reviews and compliance testing.<\/li>\n<li><strong>Corrective controls<\/strong> contain harm and prevent recurrence. Examples include customer remediation, control redesign, disciplinary action, regulatory notification and root-cause action plans.<\/li>\n<\/ul>\n<p>The official <a href=\"https:\/\/guidelines.ussc.gov\/apex\/r\/ussc_apex\/guidelinesapp\/guidelines?app_gl_id=%C2%A78B2.1\">US Sentencing Commission guideline \u00a78B2.1<\/a> identifies standards and procedures, oversight, training, monitoring and auditing, reporting mechanisms, incentives and discipline, response and periodic risk assessment as elements of an effective compliance and ethics programme. This illustrates why policy alone cannot provide a complete control environment.<\/p>\n<h2 id=\"selection\"><span class=\"ez-toc-section\" id=\"How_to_select_proportionate_compliance_controls\"><\/span>How to select proportionate compliance controls<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ol>\n<li><strong>State the obligation precisely.<\/strong> Record jurisdiction, legal entity, product, process, effective date and source.<\/li>\n<li><strong>Describe the failure scenario.<\/strong> Explain who could do what, through which process, and what consequence could follow.<\/li>\n<li><strong>Assess inherent exposure.<\/strong> Consider likelihood, impact, speed of harm, detectability and regulatory significance.<\/li>\n<li><strong>Map existing controls.<\/strong> Identify control owner, frequency, system or manual operation, dependencies and required evidence.<\/li>\n<li><strong>Test design.<\/strong> Ask whether the control would prevent, detect or correct the stated failure under realistic conditions.<\/li>\n<li><strong>Test operation.<\/strong> Sample evidence, inspect exceptions, evaluate timeliness and confirm reviewers challenged rather than merely signed.<\/li>\n<li><strong>Decide residual risk.<\/strong> Accept, improve, transfer or stop the activity within approved risk appetite and legal limits.<\/li>\n<li><strong>Monitor change.<\/strong> Reassess after regulatory, product, system, geographic, workforce or third-party changes.<\/li>\n<\/ol>\n<figure id=\"attachment_2308\" aria-describedby=\"caption-attachment-2308\" style=\"width:100%\"><img decoding=\"async\" src=\"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/02132244\/compliance-control-selection-workflow.webp\" alt=\"Workflow for selecting controls from obligation identification through testing and remediation\" width=\"1200\" style=\"max-width:100%;height:auto\" \/><figcaption id=\"caption-attachment-2308\">Control selection should connect each obligation to ownership, evidence, testing and remediation.<\/figcaption><\/figure>\n<p>For UK-regulated financial firms, the <a href=\"https:\/\/handbook.fca.org.uk\/handbook\/sysc6\">Financial Conduct Authority\u2019s SYSC 6 rules<\/a> require adequate policies and procedures and regular assessment of their adequacy and effectiveness. The principle is broadly useful elsewhere: controls must be maintained and evaluated, not simply documented.<\/p>\n<h2 id=\"example\"><span class=\"ez-toc-section\" id=\"Worked_example_onboarding_a_high-risk_distributor\"><\/span>Worked example: onboarding a high-risk distributor<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Assume a regulated manufacturer plans to appoint a distributor in a jurisdiction with high bribery and sanctions exposure. The inherent risks include improper payments, prohibited counterparties, inaccurate records, misleading promotion and mishandling of customer data.<\/p>\n<table>\n<thead>\n<tr>\n<th>Stage<\/th>\n<th>Control decision<\/th>\n<th>Evidence<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Before approval<\/td>\n<td>Ownership verification, sanctions and adverse-media screening, conflict declarations and risk-tiered due diligence<\/td>\n<td>Search results, verified documents, risk rating and approval record<\/td>\n<\/tr>\n<tr>\n<td>Contracting<\/td>\n<td>Defined territory and services, compliance warranties, audit rights, training, notification and termination clauses<\/td>\n<td>Approved contract and exceptions log<\/td>\n<\/tr>\n<tr>\n<td>Operation<\/td>\n<td>Payment controls, marketing approval, transaction monitoring and periodic certification<\/td>\n<td>Invoices, approvals, monitoring reports and attestations<\/td>\n<\/tr>\n<tr>\n<td>Review<\/td>\n<td>Risk-based refresh, exception investigation and remediation or exit decision<\/td>\n<td>Review file, findings, action owners and closure evidence<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The worked example shows why one risk may require several controls owned by different functions. Compliance owns the framework, but procurement, finance, sales, legal, information security and business management operate much of the control chain.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Common_classification_mistakes\"><\/span>Common classification mistakes<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li>Using departmental names instead of failure scenarios.<\/li>\n<li>Listing every law as a separate risk without grouping connected obligations.<\/li>\n<li>Recording a policy as the control without defining the operational action.<\/li>\n<li>Ignoring control dependencies such as data quality, access rights or staff competence.<\/li>\n<li>Assessing design but never testing actual operation.<\/li>\n<li>Closing findings on promised action rather than verified evidence.<\/li>\n<li>Treating all third parties as equal instead of applying risk tiers.<\/li>\n<\/ul>\n<h2 id=\"training\"><span class=\"ez-toc-section\" id=\"Developing_practical_compliance_capability\"><\/span>Developing practical compliance capability<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Professionals who need to translate obligations into registers, controls, monitoring plans and governance reporting can review EPW\u2019s <a href=\"https:\/\/www.epw.com\/training\/compliance-management-in-regulated-environments\">Compliance Management in Regulated Environments course<\/a>. The course focuses on obligation mapping, compliance-risk assessment, control ownership, programme implementation, testing, investigations and regulatory change.<\/p>\n<p>You can also explore the wider <a href=\"https:\/\/www.epw.com\/courses\/auditing-governance-and-risk-compliance\">Auditing, Governance, and Risk Compliance training portfolio<\/a>. For a broader explanation of how the disciplines connect, see <a href=\"https:\/\/www.epw.com\/blog\/courses\/what-is-governance-risk-and-compliance\">what governance, risk and compliance means<\/a> and EPW\u2019s introduction to <a href=\"https:\/\/www.epw.com\/blog\/courses\/what-is-compliance-and-risk-management\">compliance and risk management<\/a>.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Conclusion\"><\/span>Conclusion<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The most useful classification of regulatory compliance risk is one that improves decisions. Define the obligation, describe the failure, assign ownership, combine control layers and retain credible evidence. When the register is linked to real processes and reassessed after change, it becomes an operating tool for management and assurance rather than a catalogue of regulations.<\/p>\n<p><strong>Ready to strengthen your compliance-control system?<\/strong> Review the <a href=\"https:\/\/www.epw.com\/training\/compliance-management-in-regulated-environments\">Compliance Management in Regulated Environments course outline and available training locations<\/a>.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Sources_and_References\"><\/span>Sources and References<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ol>\n<li>US Department of Justice, Criminal Division. <a href=\"https:\/\/www.justice.gov\/criminal\/criminal-fraud\/page\/file\/937501\/dl?inline=\"><em>Evaluation of Corporate Compliance Programs<\/em><\/a>. Updated September 2024.<\/li>\n<li>United States Sentencing Commission. <a href=\"https:\/\/guidelines.ussc.gov\/apex\/r\/ussc_apex\/guidelinesapp\/guidelines?app_gl_id=%C2%A78B2.1\"><em>\u00a78B2.1 Effective Compliance and Ethics Program<\/em><\/a>. Current Guidelines Manual.<\/li>\n<li>Organisation for Economic Co-operation and Development. <a href=\"https:\/\/legalinstruments.oecd.org\/en\/instruments\/oecd-legal-0378\"><em>Recommendation for Further Combating Bribery of Foreign Public Officials in International Business Transactions<\/em><\/a>, including Annex II Good Practice Guidance. Amended 2021.<\/li>\n<li>Information Commissioner\u2019s Office. <a href=\"https:\/\/ico.org.uk\/for-organisations\/advice-and-services\/audits\/data-protection-audit-framework\/\"><em>Data Protection Audit Framework<\/em><\/a>. Accessed 1 September 2026.<\/li>\n<li>Financial Conduct Authority. <a href=\"https:\/\/handbook.fca.org.uk\/handbook\/sysc6\"><em>SYSC 6: Compliance, Internal Audit and Financial Crime<\/em><\/a>. Accessed 1 September 2026.<\/li>\n<li>National Institute of Standards and Technology. <a href=\"https:\/\/csrc.nist.gov\/pubs\/sp\/800\/53\/r5\/final\"><em>SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations<\/em><\/a>. September 2020, including subsequent updates.<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"<p>A practical classification of eight regulatory compliance risk types, with example controls, evidence requirements and a step-by-step method for choosing proportionate measures.<\/p>\n","protected":false},"author":1,"featured_media":2306,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[],"class_list":["post-2228","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-auditing-governance-and-risk-compliance-articles"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.7 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Types of Regulatory Compliance Risks and Controls<\/title>\n<meta name=\"description\" content=\"Explore eight types of regulatory compliance risks, their controls and evidence, with a practical method for selecting proportionate compliance measures.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Types of Regulatory Compliance Risks and Controls\" \/>\n<meta property=\"og:description\" content=\"Explore eight types of regulatory compliance risks, their controls and evidence, with a practical method for selecting proportionate compliance measures.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls\" \/>\n<meta property=\"og:site_name\" content=\"Blog Categories - EPW Training\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-02T13:23:29+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/02132218\/regulatory-compliance-risks-controls-map-1.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"EPW Training Blog\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"EPW Training Blog\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":[\"Article\",\"BlogPosting\"],\"@id\":\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls\"},\"author\":{\"@type\":\"Organization\",\"name\":\"EPW Training Blog\",\"url\":\"https:\/\/www.epw.com\/blog\/\",\"@id\":\"https:\/\/www.epw.com\/blog\/#organization\"},\"headline\":\"Types of Regulatory Compliance Risks and Controls\",\"datePublished\":\"2026-09-02T13:23:29+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls\"},\"wordCount\":2012,\"publisher\":{\"@id\":\"https:\/\/www.epw.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls#primaryimage\"},\"thumbnailUrl\":\"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/02132218\/regulatory-compliance-risks-controls-map-1.webp\",\"articleSection\":[\"Auditing, Governance, and Risk Compliance Articles\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls\",\"url\":\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls\",\"name\":\"Types of Regulatory Compliance Risks and Controls\",\"isPartOf\":{\"@id\":\"https:\/\/www.epw.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls#primaryimage\"},\"thumbnailUrl\":\"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/02132218\/regulatory-compliance-risks-controls-map-1.webp\",\"datePublished\":\"2026-09-02T13:23:29+00:00\",\"description\":\"Explore eight types of regulatory compliance risks, their controls and evidence, with a practical method for selecting proportionate compliance measures.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls#primaryimage\",\"url\":\"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/02132218\/regulatory-compliance-risks-controls-map-1.webp\",\"contentUrl\":\"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/02132218\/regulatory-compliance-risks-controls-map-1.webp\",\"width\":1280,\"height\":720,\"caption\":\"Illustrative compliance risk-and-control mapping for a regulated organisation.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.epw.com\/blog\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Types of Regulatory Compliance Risks and Controls\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.epw.com\/blog\/#website\",\"url\":\"https:\/\/www.epw.com\/blog\/\",\"name\":\"Blog Categories - EPW Training\",\"description\":\"Expert Insights and Updates in Professional Training\",\"publisher\":{\"@id\":\"https:\/\/www.epw.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.epw.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.epw.com\/blog\/#organization\",\"name\":\"Blog Categories - EPW Training\",\"url\":\"https:\/\/www.epw.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.epw.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.epw.com\/blog\/wp-content\/uploads\/2025\/08\/epw-training-blog-logo.png\",\"contentUrl\":\"https:\/\/www.epw.com\/blog\/wp-content\/uploads\/2025\/08\/epw-training-blog-logo.png\",\"width\":746,\"height\":256,\"caption\":\"Blog Categories - EPW Training\"},\"image\":{\"@id\":\"https:\/\/www.epw.com\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.epw.com\/blog\/#person\",\"name\":\"EPW Training Blog\",\"sameAs\":[\"https:\/\/www.epw.com\/blog\/\"],\"url\":\"https:\/\/www.epw.com\/blog\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Types of Regulatory Compliance Risks and Controls","description":"Explore eight types of regulatory compliance risks, their controls and evidence, with a practical method for selecting proportionate compliance measures.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls","og_locale":"en_US","og_type":"article","og_title":"Types of Regulatory Compliance Risks and Controls","og_description":"Explore eight types of regulatory compliance risks, their controls and evidence, with a practical method for selecting proportionate compliance measures.","og_url":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls","og_site_name":"Blog Categories - EPW Training","article_published_time":"2026-09-02T13:23:29+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/02132218\/regulatory-compliance-risks-controls-map-1.webp","type":"image\/webp"}],"author":"EPW Training Blog","twitter_card":"summary_large_image","twitter_misc":{"Written by":"EPW Training Blog"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":["Article","BlogPosting"],"@id":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls#article","isPartOf":{"@id":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls"},"author":{"@type":"Organization","name":"EPW Training Blog","url":"https:\/\/www.epw.com\/blog\/","@id":"https:\/\/www.epw.com\/blog\/#organization"},"headline":"Types of Regulatory Compliance Risks and Controls","datePublished":"2026-09-02T13:23:29+00:00","mainEntityOfPage":{"@id":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls"},"wordCount":2012,"publisher":{"@id":"https:\/\/www.epw.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls#primaryimage"},"thumbnailUrl":"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/02132218\/regulatory-compliance-risks-controls-map-1.webp","articleSection":["Auditing, Governance, and Risk Compliance Articles"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls","url":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls","name":"Types of Regulatory Compliance Risks and Controls","isPartOf":{"@id":"https:\/\/www.epw.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls#primaryimage"},"image":{"@id":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls#primaryimage"},"thumbnailUrl":"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/02132218\/regulatory-compliance-risks-controls-map-1.webp","datePublished":"2026-09-02T13:23:29+00:00","description":"Explore eight types of regulatory compliance risks, their controls and evidence, with a practical method for selecting proportionate compliance measures.","breadcrumb":{"@id":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls#primaryimage","url":"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/02132218\/regulatory-compliance-risks-controls-map-1.webp","contentUrl":"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/02132218\/regulatory-compliance-risks-controls-map-1.webp","width":1280,"height":720,"caption":"Illustrative compliance risk-and-control mapping for a regulated organisation."},{"@type":"BreadcrumbList","@id":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/regulatory-compliance-risks-controls#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.epw.com\/blog"},{"@type":"ListItem","position":2,"name":"Types of Regulatory Compliance Risks and Controls"}]},{"@type":"WebSite","@id":"https:\/\/www.epw.com\/blog\/#website","url":"https:\/\/www.epw.com\/blog\/","name":"Blog Categories - EPW Training","description":"Expert Insights and Updates in Professional Training","publisher":{"@id":"https:\/\/www.epw.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.epw.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.epw.com\/blog\/#organization","name":"Blog Categories - EPW Training","url":"https:\/\/www.epw.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.epw.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.epw.com\/blog\/wp-content\/uploads\/2025\/08\/epw-training-blog-logo.png","contentUrl":"https:\/\/www.epw.com\/blog\/wp-content\/uploads\/2025\/08\/epw-training-blog-logo.png","width":746,"height":256,"caption":"Blog Categories - EPW Training"},"image":{"@id":"https:\/\/www.epw.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.epw.com\/blog\/#person","name":"EPW Training Blog","sameAs":["https:\/\/www.epw.com\/blog\/"],"url":"https:\/\/www.epw.com\/blog\/"}]}},"_links":{"self":[{"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/posts\/2228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/comments?post=2228"}],"version-history":[{"count":3,"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/posts\/2228\/revisions"}],"predecessor-version":[{"id":2309,"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/posts\/2228\/revisions\/2309"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/media\/2306"}],"wp:attachment":[{"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/media?parent=2228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/categories?post=2228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/tags?post=2228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}