Managing legal risk

Managing legal risk

All commercially successful organisations take risks. Without taking risks, an organisation will stand still, which is a risk in itself.

Organisations take risks in return for increased revenue or profit. Commercial organisations are unlikely to want to eliminate risk altogether, but are likely to want to control it so they can reap the benefits of taking risks while mitigating potential negative consequences.

What is risk?

The informal notion of risk as the chance that ‘something bad might happen’ is one place to start to define risk. A more tangible and easily understood approach is to define risk as probability multiplied by impact.

So, for any given legal risk faced by your business, there are two questions:

•
how likely is it that the risk will materialise, ie what’s the probability?
•
if the risk does materialise, how bad will it be, ie what’s the impact?

You can then evaluate the risk, by adopting a simple risk matrix or scoring system.

How likely is it that the risk will materialise, ie what’s the probability?

Assign a score to your answer between 1 and 5
(where 1 = very low probability

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

TAKE A FREE TRIAL

Latest Practice Compliance News

Transparency of AI-generated content—the EU's first draft Code of Practice

EU Law analysis: As the pace of generative AI accelerates, it seems that the risk of harm (from issues such as misinformation and deepfakes) grows too. The EU's draft Code of Practice on Transparency of AI-Generated Content (draft Code) aims to address this with specific operational measures which signpost the principal actors in the AI value chain towards compliance with the transparency requirements of the EU AI Act (Act). Key measures include: requirements for marking, detection and disclosure; specific rules on deepfakes and matters of public interest; and internal governance, monitoring and training.

New Practice Compliance forecast as at 17 February 2026

Our new Practice Compliance forecast (as at 17 February 2026) is now live. This month we report on items including (1) HMRC’s confirmed changes to the Economic Crime Levy from April 2026, (2) the JMLSG’s publication of final revisions to Part I of its AML guidance, (3) the ICO’s plans to update existing guidance on the privacy notice generator, and (4) the LSB’s interim report from its targeted review following Mazur.

OFSI launches call for evidence on ownership and control test in UK sanctions

The Office of Financial Sanctions Implementation (OFSI) has launched a call for evidence seeking views on how UK financial sanctions regulations on ownership and control are applied in practice, including how firms implement the regulations and where they face challenges, with a particular focus on ‘hypothetical control’. His Majesty’s Government (HMG) is seeking practical examples of how often hypothetical control arises, its impact on compliance costs, legal risk and business decisions (including de-risking) and whether existing legal concepts and typologies of control assist in applying the ownership and control test.

EU Commission sets out priorities for AI Act implementation

MLex: The European Commission has identified its 2026 priorities for implementing the EU AI Act, focusing on procedural rules for general-purpose AI models, regulatory sandboxes and the AI Office’s market surveillance role. Several rules implementing the AI law, including the criteria for designating a model ‘with systemic risk’ and the methodology to estimate energy consumption, have been de-prioritised, according to an internal document seen by MLex.

View Practice Compliance by content type :

News