Risk and compliance analysis