The Risk Assessment That Never Changed
A regional payments company completed its first enterprise-wide compliance risk assessment three years ago. The methodology scored each business line on inherent risk and control effectiveness, producing a heat map. Since then the company has launched a cross-border remittance product, onboarded two agent networks in higher-risk jurisdictions, and doubled transaction volume. The risk assessment has not been refreshed. The compliance officer has repeatedly asked for budget to update it and been told the exercise is "a paperwork requirement" and that the heat map still "broadly holds." The compliance team has six staff for roughly 400,000 customer accounts. Monitoring is manual sampling of 30 transactions per month, chosen by the operations supervisor whose team processes them. Last quarter, an agent network was suspended by a partner bank after unusual structuring patterns appeared; the company's own monitoring had not flagged anything.
1. Explain how the stale risk assessment connects causally to the missed structuring activity, rather than treating them as separate problems.
Read the worked answer
The risk assessment is the document that tells the firm where to point scarce resources. If it has not been refreshed, it still reflects a domestic, lower-volume, lower-complexity business. The cross-border product, the new agents, and the doubled volume all change the risk profile, but none of that is reflected in the scoring that justifies staffing, monitoring thresholds, and training content.
The causal chain runs like this. Because the assessment understates risk in the new channels, the monitoring plan allocates its limited 30-transaction sample without weighting toward agents or cross-border flows. Because the sample is unweighted and manual, structuring across many small transactions in an agent network is unlikely to be caught. Because the operations supervisor selects the sample, there is also a selection bias toward routine, well-documented transactions. The result is a monitoring programme that is technically running but structurally blind to the highest-risk activity.
The partner bank's suspension is therefore not bad luck. It is what happens when an external party applies sharper scrutiny than the firm applies to itself. The lesson is that a risk assessment is a live instrument; a heat map that has not moved while the business has transformed is not a control, it is a historical artefact.
2. Design a refreshed risk assessment approach that the compliance officer could actually run with six staff, and justify the trade-offs.
Read the worked answer
With six staff, a full quantitative model across every business line is not feasible and would consume the team's capacity. A proportionate approach is better.
First, scope by product, channel, customer type, and geography rather than by department, because the new risks sit in the cross-border product and the agent networks. Second, use a small set of factors per dimension: transaction volume, geographic risk, customer transparency, delivery channel, and payment method. Score inherent risk on a simple three- or four-point scale with written descriptors so scores are reproducible.
Third, assess control effectiveness separately, using evidence rather than opinion: does the control exist, is it designed sensibly, is it operating, and has testing confirmed it? Fourth, calculate residual risk and use it to rank where monitoring, training, and staffing go. Fifth, document the rationale for each score in a short narrative, because the reasoning is what regulators and auditors will test.
The trade-offs are explicit. The firm sacrifices granularity and statistical sophistication to gain timeliness and defensibility. It should compensate by refreshing quarterly at a light touch and annually in full, and by requiring the assessment to be re-run whenever a new product, channel, or market is approved. Build the refresh trigger into the product approval process so the assessment cannot silently go stale again.
3. The executive team resists because the exercise consumes analyst time. What argument and what evidence should the compliance officer bring?
Read the worked answer
The compliance officer should reframe the conversation from cost to allocation. The question is not whether the firm spends effort on risk assessment but whether it spends monitoring and training effort in the right places. The current 30-transaction sample is already a cost; it is simply being spent where it catches least.
The evidence to bring is concrete. Show the agent suspension and the partner bank's finding next to the firm's own monitoring output, and ask which control caught the risk. Show the volume and product changes since the last assessment and mark on the old heat map where the new activity actually sits. Show the staffing ratio of six analysts to 400,000 accounts and note that without prioritisation, effort spreads thinly across everything. Where possible, estimate the cost of a lost banking relationship or a remediation exercise against the cost of a refresh.
The argument should also address the executive's real concern, which is disruption. Propose a bounded refresh: a defined scope, a named owner, a completion date, and a deliverable of one page per business line. Offer to present the refreshed top risks and the resulting changes to monitoring within a quarter. A visible, small win builds the case for a standing process better than an abstract argument about regulatory expectations.