[Compliance] How do you manage risk without sounding like HR only says no?

I try to talk about risk in terms of decisions and alternatives, not just restrictions. If HR only shows up to block things, managers stop hearing the judgment behind the concern and start hearing only friction. So when I raise risk, I want to explain what the risk actually is, what it could turn into, and what safer path still gives...