risk and legal compliance auditor