2016 compliance risk study