Compliance and non-financial risks