Understanding risk assessment and compliance mapping Start with the files, not the vendor. Pull a clean inventory of matter files, HR records, corporate records, correspondence, and anything that contains client-identifying information. Then separate what is routine from what is sensitive, because the control set should change with the data class,