Risk and compliance framework