System and method for risk assessment of compliance are disclosed. A database is provided, which contains mapped compliance data components related to regulations, requirements, policies and standards, controls, and assets. Users can specify the weighting of the data components based on the user's business requirements. Manual and automated assessments are used to measure and determine the state of compliance of assets, such as people, processes, and technology. In particular, assessments may be performed on the standards and controls related to people, processes, and technology. Various compliance and risk indices are computed based on the compliance status of the standards and controls. Reports and analysis using the compliance data components and the compliance and risk indices are provided to quantify compliance risks and to assess overall compliance.