Build a compliance risk register that ranks by actual exposure instead of listing every possible risk equally

Build a compliance risk register from the areas I describe below. The output needs to rank risks by actual exposure, not just list them — a register where everything looks equally urgent is not useful to leadership deciding where to spend limited time.

COMPLIANCE AREAS TO ASSESS
Data privacy handling, workplace safety documentation, and vendor contract compliance.

ORGANIZATION PROFILE
80-person manufacturing company, handles customer PII for e-commerce orders, has a physical warehouse floor.

CURRENT MITIGATIONS IN PLACE
Data encrypted in transit but not at rest; warehouse safety training done annually but not tracked per employee.

WHO REVIEWS THIS REGISTER
Executive leadership team deciding Q3 budget priorities.

BUILDING THE REGISTER
For each compliance area, state the specific risk in concrete terms — not "data privacy risk" as a category, but the actual thing that could go wrong ("customer PII stored without encryption at rest, discovered during a breach"). Rate likelihood and impact separately using a simple scale (Low/Medium/High) based on the organization profile and current mitigations you were given, and explain the rating in one sentence rather than leaving the score unjustified — an unexplained score is not something the audience can push back on or trust. Cross-reference against the mitigations described so a risk with a strong existing control gets rated differently than the same risk with nothing in place — do not rate risks in a vacuum as if no mitigation existed when one was described. Sort the final register by combined exposure (likelihood x impact), highest first, so the audience reads top-to-bottom in priority order rather than having to re-sort a flat list themselves.

WHAT NOT TO DO
Do not assign a specific dollar figure or fine amount to any risk unless one was given to you — invented financial figures in a document leadership might act on are worse than no figure at all. Do not state that a risk is or isn't currently a compliance violation — a risk register describes exposure and priority, not a legal determination of current compliance status.

OUTPUT FORMAT
1. Ranked risk register table: Risk (specific) | Likelihood | Impact | Rating rationale | Current mitigation | Combined exposure.
2. Top 3 priorities called out separately with a one-line "why this first" for each.
3. A closing note stating this register is a prioritization tool built from the information described, not a legal compliance audit or determination — a qualified compliance lawyer or auditor should validate the actual compliance status of each area before this register is used to make final resourcing or disclosure decisions.