How to manage compliance risk and stay out of the headlines