Compliance is a minimal bar to meet an arbitrary but hopefully useful standard. Lowering your overall risk may make you more compliant by some standards, but it also may not. Meeting compliance may lower your risk, but it also may not. The two ideas are related and can often be treated by the same process and improvements but they are not 1:1.