where an organisation could be exposed to legal reprimands if a compliance risk came to fruition