How to Run a Compliance Gap Analysis

A compliance review rarely fails because a firm has no policies. It fails because practice has drifted from policy, controls no longer match the risk profile, or regulatory expectations have moved on while the business kept operating as usual. That is why understanding how to run a compliance gap analysis matters. Done properly, it gives decision-makers a clear view of where obligations, internal controls and operational reality no longer align.

For firms subject to AML, KYC, CDD and broader regulatory obligations, a gap analysis is not an academic exercise. It is a practical way to test whether your framework remains proportionate, defensible and capable of standing up to internal audit, external review or regulatory scrutiny. It should do more than produce a traffic-light chart. It should show what is missing, why it matters, and what needs to change first.

What a compliance gap analysis is really testing

At its core, a compliance gap analysis compares three things: the rules you must meet, the controls you say you operate, and the evidence of what actually happens in practice. The gaps sit in the space between them.

In an AML context, that may include weaknesses in customer risk assessment, incomplete source of funds checks, poorly evidenced enhanced due diligence, inconsistent sanctions screening, inadequate ongoing monitoring, or governance arrangements that do not reflect current regulatory expectations. In other sectors, the detail changes, but the principle does not. The exercise is designed to reveal whether your control environment is complete, current and functioning.

That distinction matters. A policy can exist and still be ineffective. A process can be followed and still fall short of the applicable standard. Equally, some apparent gaps are not equally serious. A missing procedural cross-reference is not the same as onboarding high-risk clients without documented rationale.

How to run a compliance gap analysis with the right scope

The biggest mistake at the start is trying to review everything at once. A useful gap analysis begins with scope discipline. You need to define which regulations, business lines, jurisdictions, products, client types and control areas are in scope, and why.

For many regulated businesses, the most sensible starting point is the highest-risk activity. That often means client onboarding, customer due diligence, transaction monitoring, suspicious activity escalation, record keeping, training, governance and independent testing. If your firm has recently entered a new market, launched a new product, changed ownership structure or received audit findings, those areas should usually move up the priority list.

You also need a baseline. That means identifying the regulatory requirements, industry guidance, internal policies, procedures and risk appetite statements against which you will assess the framework. Without that baseline, the exercise quickly becomes subjective. A good review is anchored in clear criteria, not general impressions.

Start with regulatory requirements, not internal assumptions

A sound method for how to run a compliance gap analysis starts outside the business, not inside it. Begin by mapping the obligations that apply to your firm. This may include legislation, local rules, supervisory guidance, sector-specific requirements and internal commitments already approved by the board or senior management.

Once that map is established, translate each requirement into a practical control expectation. For example, if the regulation requires enhanced due diligence for higher-risk relationships, what does that mean operationally? It may mean documented triggers, escalation routes, evidence standards, senior approval thresholds, review frequencies and quality assurance checks. This step is where broad obligations become testable.

Firms often stumble here because they stop at policy wording. Regulators and auditors do not assess compliance solely on whether a requirement is mentioned in a document. They assess whether it has been built into procedures, systems, oversight and decision-making.

Assess design first, then operating effectiveness

A gap analysis should separate control design from control performance. These are related, but not identical.

Design assessment asks whether the control framework, if followed properly, would meet the requirement. Are policies current? Are procedures clear? Are roles allocated? Are escalation thresholds defined? Is there a risk-based methodology behind onboarding and monitoring decisions? If the answer is no, the gap exists even before you sample a single file.

Operating effectiveness asks whether the designed control is actually working in practice. This usually requires file reviews, walkthroughs, interviews, system checks and testing of evidence trails. You may find that onboarding analysts are applying different standards, reviewers are approving exceptions without rationale, or periodic reviews are overdue despite a compliant-looking policy suite.

This two-stage approach prevents a common problem: assuming control failure is purely an execution issue when the real weakness is poor design, or blaming policy language when staff are simply not following an otherwise reasonable process.

Gather evidence from the front line

If you want an accurate result, do not confine the review to documents shared by compliance. Speak to operations, client-facing teams, senior approvers and anyone involved in onboarding, monitoring or exception handling. Walk through actual cases from initiation to approval. Ask how edge cases are handled. Check whether the system forces key steps or merely suggests them.

This is where the most valuable findings usually emerge. A procedure may state that high-risk clients require enhanced checks before approval, while in practice temporary workarounds allow accounts to progress with documents to follow. A policy may require periodic reviews based on risk rating, but the data feeding those reviews may be incomplete or unreliable. These are not drafting issues. They are operational and governance risks.

Evidence should be contemporaneous and traceable. If a control cannot be evidenced, it may as well not exist from an audit perspective. That is especially important in AML environments, where firms need to demonstrate not only that decisions were made, but that they were made on a rational, risk-based basis.

Rate gaps by risk, not by convenience

Not every finding deserves the same level of attention. Once gaps are identified, assess them against impact, likelihood, regulatory significance and root cause. This helps distinguish between housekeeping matters and issues that expose the business to enforcement risk, financial crime exposure or serious reputational damage.

A practical rating model should consider whether the gap affects legal or regulatory obligations, the volume or value of impacted relationships, the risk level of affected customers, the duration of the issue, and whether compensating controls exist. It should also ask a harder question: could senior management defend the current position if challenged tomorrow?

Trade-offs matter here. Some firms rush to close visible documentation gaps because they are easy to fix, while leaving inconsistent onboarding decisions unresolved because those changes affect systems, training and workflow. That may improve appearances without materially reducing risk. A risk-based remediation plan does the opposite. It focuses first on the weaknesses that matter most.

Build a remediation plan that can actually be delivered

A gap analysis is only useful if it leads to action. Findings should therefore be translated into a remediation plan with clear ownership, realistic deadlines and defined success criteria.

The best plans do not simply say “update the policy”. They specify the action required across policy, procedure, systems, training, oversight and testing. If client risk assessments are inconsistent, the answer may involve revising the scoring methodology, retraining reviewers, tightening approval controls, updating templates and introducing quality assurance sampling. A single recommendation rarely resolves a multi-layered issue.

It is also important to distinguish between immediate containment and longer-term enhancement. Some gaps require urgent interim controls while broader changes are being implemented. For example, if an onboarding control is failing, you may need temporary manual reviews before a system change can be delivered.

For firms operating in complex or fast-moving environments, remediation should be proportionate. Over-engineering every control can create delay, duplication and staff workarounds. The stronger approach is to design controls that are defensible, usable and aligned to actual risk.

Governance is where good gap analyses hold their value

A compliance gap analysis should not end when the report is issued. Senior management and the board need visibility over key findings, remediation status, residual risk and any decisions to accept or defer action. That governance trail matters. It shows that the business has identified issues, assessed them properly and responded in a controlled manner.

This is also where many one-off reviews lose value. Requirements change, products evolve and operational shortcuts reappear under pressure. A gap analysis should feed into an ongoing compliance monitoring programme, internal audit planning and periodic risk assessment updates. In practice, the most resilient firms treat it as part of a wider control improvement cycle rather than a one-time exercise before an inspection.

For organisations that want clearer reporting and more actionable recommendations, an external perspective can help challenge internal assumptions and identify blind spots that routine monitoring may miss. That is often where Complipal adds value – translating regulatory expectations into practical control improvements that teams can implement and defend.

A well-run gap analysis does more than identify what is wrong. It gives leadership a clearer basis for judgement, sharper control over remediation, and greater confidence that growth is not outpacing governance.