The risk assessment: the document everything rests on.

What it is for

Every other control in an AML programme is supposed to follow from this document. The customer risk model, the monitoring scenarios, the thresholds, the depth of due diligence, where the people and the budget go — all of it is meant to be proportionate to risks identified here.

That makes the business-wide risk assessment the first thing an examiner asks for, and the easiest thing in the programme to produce as a ritual. Many are written once, presented, filed, and contradicted daily by what the institution actually does.

What it is actually for. The Wolfsberg Group's FAQs on risk assessments put the purpose as driving improvements in financial crime risk management, by identifying the general and specific risks an institution faces and determining how those risks are mitigated by its controls. Note the two halves: identify the risk, then establish what is being done about it. An assessment that lists risks without assessing controls has done half the job.

The same guidance sets out what the output is used for, and the list is worth testing your own document against:

• Make senior management aware of the key risks, control gaps and remediation efforts.
• Assist senior management with strategic decisions, including commercial exits and disposals.
• Make regulators aware of the key risks, control gaps and remediation.
• Help management ensure resources and priorities are aligned with the risks.

Read the second one again. A risk assessment is supposed to be capable of changing what business the institution is in. If yours has never influenced a commercial decision, it is probably describing a programme rather than assessing one.

The supervisory expectation is the same. The Basel Committee's guidance on the sound management of risks related to money laundering and terrorist financing states that sound risk management requires identifying and analysing the risks present within the bank, and designing and effectively implementing policies and procedures commensurate with the identified risks — considering inherent and residual risk factors at the country, sectoral, bank and business relationship level, to determine the risk profile and the appropriate level of mitigation.

Four levels, in one sentence: country, sector, institution, relationship. An assessment that works only at one of them is incomplete.

No single method is required. Wolfsberg notes there are many ways to conduct a risk assessment, and each institution should implement methodologies appropriate to its size, footprint, markets, organisation and risk appetite. What is required is that whatever you choose is deliberate, documented and defensible.

And it needs real support. The guidance observes that for a risk assessment to succeed, senior management and key stakeholders should support the effort in the context of fostering a robust culture of compliance. A compliance team producing this alone, from data the business did not help assemble, will produce a document the business does not recognise.

Inherent risk

Inherent risk is exposure before your controls are considered — what this business would attract if nobody were watching. Assessing it honestly is uncomfortable, because a high inherent score is not a criticism. It is a description of the business the institution has chosen to be in.

Likelihood and impact. Wolfsberg describes assessing the likelihood and impact of money laundering and terrorist financing scenarios occurring as a way of calculating inherent risk. Both terms matter:

• Likelihood — how probable is it that this risk materialises here, given the customers, products, channels and places the institution actually operates in.
• Impact — what follows if it does. Loss, regulatory consequence, harm to the financial system, harm to real people. Terrorist financing is the clearest case where impact is enormous while the sums are trivial, which is why likelihood alone cannot be the measure.

Work in scenarios, not categories. A line in a table reading "Correspondent banking — High" asserts something without saying what. A scenario states the mechanism: a respondent institution's underlying customers use our correspondent account to move proceeds of fraud through a jurisdiction where we have no visibility. Now there is something a control can be tested against, and something a reviewer can disagree with.

The factors to work through, at each of the four levels the Basel Committee names:

• Customers — types, volumes, concentrations, cash intensity, ownership complexity, politically exposed persons, non-resident customers.
• Products and services — how easily each moves value, to whom, and how visibly. New products deserve particular attention, because they are the ones no scenario has been written for.
• Channels — branch, agent, intermediary, online, through introducers or third parties.
• Geography — where you operate, where your customers are, where the money goes.
• Other — transaction volumes and values, the sectors you serve, delivery through partners, and any recent change in any of the above.

The two failure modes.

Optimism. Scoring inherent risk low because the controls are good. This collapses the whole structure — if inherent risk already includes mitigation, residual risk is meaningless and the assessment cannot show what the controls are actually doing.

Uniformity. Everything rated medium. Usually the product of a committee that could not agree, and it produces a document that cannot prioritise anything, which is the one thing it exists to do.

Use what you know. Your own history is evidence: reports filed, alerts investigated, cases confirmed, incidents, audit findings, regulatory feedback, exits. An institution that assesses its risks without consulting its own record is guessing in a room where the answers are on file.

Controls and residual risk

Residual risk is what remains after controls. Getting from inherent to residual honestly is the hardest part of the exercise, and the part most often fudged — because scoring your own controls means writing down where they are weak.

Design and operation are different questions. A control can be well designed and badly run, or poorly designed and diligently performed. Both need stating:

• Design — would this control catch the thing, if it worked as intended?
• Operating effectiveness — does it in fact work, consistently, with the data and the people it actually has?

A monitoring scenario perfectly designed for a risk, running against a field populated in a third of records, is a well-designed control with poor operating effectiveness. Recording that as "effective" is the single most common way a risk assessment becomes fiction.

Score controls on evidence, not on existence. The question is not whether a policy exists. The useful evidence is: testing results, audit findings, quality assurance outcomes, error and backlog rates, coverage statistics, data completeness on the fields the control depends on, and how many of its outputs turn out to be right. Where none of that exists for a control, the honest score is low confidence — and the finding is that the control has never been tested.

Say what the gap is and what is being done. A residual risk that stays high is not a failure of the assessment; it is the assessment working. What matters is that it is named, owned, given a remediation plan with a date, and reported upward. Wolfsberg's list of uses puts this explicitly: make senior management and regulators aware of the key risks, control gaps and remediation efforts.

Risk appetite is the other half. Residual risk only means something against a stated appetite. If the institution has decided it will not accept more than a given level of exposure in a given area, then a residual rating above it demands a decision — strengthen controls, reduce the business, or formally accept the excess at a level senior enough to own it. Without a stated appetite, every residual rating is just a number, and nothing follows from it.

Align to other risk frameworks. Wolfsberg notes that risk assessments are also carried out by control functions outside compliance, and that institutions should seek a common principles-based approach across them — operational risk frameworks already contain scoring and rating methodologies, and assessing the likelihood and impact of scenarios serves both. Two frameworks rating the same business differently, in the same building, is a question someone will eventually ask.

Scoring, weighting and aggregation

The methodology must be written down. Wolfsberg is specific that the approach should be clearly documented and approved by senior management, and that the methodology must be clearly articulated — the factors being assessed, the criteria used to score, the weightings used, any scoring overrides including the rationale for them, and any business-line or business-unit specific parameters.

Test your own against that list. Most assessments state the factors and the scores. Far fewer state the criteria that distinguish a three from a four, which is what makes the exercise repeatable by anyone other than its author.

Scales. Any scale works if it is defined. What matters is that each point means something stated — not "high" as a feeling, but a description someone else could apply to the same evidence and reach the same answer. An even number of points forces a choice; an odd number permits the middle, and the middle is where uncomfortable assessments go to hide.

Weighting. Not every factor matters equally, and the weights are the institution's judgement rather than a given — which is exactly why they must be recorded with their reasoning. A factor weighted so lightly it can never move an outcome is not a safeguard; it is decoration that makes the table look thorough.

Overrides. Wolfsberg acknowledges these directly: while arbitrary scoring overrides may not be the norm, there may be instances where a manual override is necessary — especially in the first few times a risk assessment is conducted, until the methodology stabilises. That is a realistic allowance, and it carries an implication. Overrides in year one are expected. Overrides still recurring in year four are telling you the methodology has not stabilised and should be changed, not overridden again.

Aggregation is where the answer gets lost. Wolfsberg notes that for enterprise-wide assessments a number of risk assessments may be aggregated to a single level, and that who owns the exercise depends on whether it is run by business line, country, region or enterprise-wide, and on the institution's structure and complexity.

The danger is arithmetic. A serious, concentrated risk in one small business line averages into insignificance across a large institution. Three defences:

• Never let aggregation hide a maximum. Report the highest residual ratings alongside the average, always.
• Keep the granular assessments available. The aggregate is a summary, not a replacement; a reviewer must be able to open the unit underneath it.
• Weight by exposure, not by headcount or revenue. A small unit with large exposure should not be diluted by a large unit with little.

Comparability has limits. Wolfsberg notes the value of understanding how a methodology compares across the industry — useful for sense-checking, but no substitute for an assessment grounded in your own business. Another institution's weightings describe another institution's risks.

Making it change something

An assessment that changes nothing has failed, however well written. The test is simple: name three things the institution did differently because of the last one. If that is hard, the document is describing the programme rather than directing it.

What should follow from it. Each of these is a thread a reviewer can pull:

• Customer risk model — the factors and weights should reflect the risks the assessment found. If the assessment names three priority risks and the rating model does not weight any of them, one document is wrong.
• Monitoring scenarios — the detection in production should map to the assessed risks. Alerts clustering entirely on a risk the assessment rated low is a contradiction worth resolving.
• Due diligence depth — the highest-risk customers should attract the most rigorous controls, through onboarding standards, enhanced due diligence, enhanced monitoring, or more frequent review. Wolfsberg puts this plainly: internal controls should be proportionately aligned to the risks posed by the range of clients.
• Resourcing and training — people and budget placed where the risk is, and training that reflects what this institution actually faces rather than generic typologies.
• Business decisions — products not launched, markets not entered, relationships exited.

How often. Wolfsberg declines to prescribe a frequency, noting it depends on the methodology, the extent of interim validation and verification, the results themselves, and internal or external risk events — and observing that some institutions refresh annually. The sensible reading is that an annual cycle is a floor and not the answer: the assessment should also move when something happens that could change it.

Triggers worth defining in advance: a new product, market or channel; an acquisition or disposal; a significant change in customer mix or volumes; a major incident, enforcement action or audit finding; a change in the external risk picture such as a country's designation; and a material change to a control, including a system replacement.

Approval. The methodology and the output should be documented and approved by senior management. The purpose is not a signature — it is that someone accountable has read the conclusions, understood the gaps, and accepted the residual risk or required it to be reduced.

What an examiner will actually test. Less the document than its connections. Does the assessment reflect the business as it is now? Is the inherent rating honest, or suspiciously low for the business being done? Are control scores supported by testing evidence rather than assertion? Are gaps named with owners and dates? Can you show the chain from a risk in this document to a specific control, threshold or decision? And did anything change as a result?

The honest version is the useful one. An assessment that admits high inherent risk, scores some controls as weak, and names what is being done about it is far stronger than one that rates everything comfortably. The first is a working document. The second is evidence that nobody looked hard.

Your certificate of completion

Enter your name as you want it to appear, then save the certificate as a PDF. In the print window, choose Save as PDF. A certificate is issued once per completion of the course.

Saolix does not record who takes this course, so it cannot verify these certificates. The certificate confirms completion of a free self-paced course and is not an accredited qualification.