where an organisation could be exposed to legal reprimands if a compliance risk came to fruition This risk is more concerned about what could happen if an incident where to occur, and it exposed the company to which it was not following its legal obligations.