Risk Assessment and Management
From enterprise to individual
Risk assessment operates at three levels: enterprise-wide (the firm's business model, customer base, geography, products, channels), customer (individual or entity risk rating), and transaction (anomaly detection against expected behaviour). A credible methodology scores inherent risk, applies control effectiveness, and produces residual risk. Questions often test whether the candidate understands that a low residual risk rating does not eliminate the duty to monitor.
Concepts to master
- Risk factors: customer, country/geography, product/service, channel, and delivery. Volume of transactions is a factor but not the only one.
- Control testing: controls must be independently tested; a documented control that is not operating is worse than none because it creates false assurance.
- Appetite and tolerance: the board sets risk appetite; the compliance function translates it into thresholds.
- Emerging risk: sanctions changes, new payment methods, and geopolitical events should feed into periodic reassessment.
Traps
Treating a risk assessment as a one-off document rather than a living process. Confusing inherent risk with residual risk. Assuming high-risk customers must be exited - the requirement is enhanced management, and exit is one option among several.
Worked example
A firm rates a customer low risk on onboarding. Six months later the customer's transaction volumes triple and counterparties shift to a higher-risk jurisdiction. Because risk assessment is continuous, the trigger should prompt a review and possible re-rating - not a wait until the annual refresh.
Rule of thumb
Residual risk = inherent risk tempered by controls that have been tested, not merely written.