Risk Assessment and Management
What the domain tests
Risk assessment is the engine of a risk-based program. Candidates must understand how an organization identifies, evaluates, prioritizes, and mitigates compliance risk, and how that assessment drives allocation of training, monitoring, and audit resources. Know the difference between inherent risk (before controls) and residual risk (after controls), and between likelihood and impact as scoring dimensions.
Concepts to master
- Risk taxonomy: legal/regulatory, operational, reputational, financial, and third-party risk.
- Methodology: risk registers, heat maps, scoring scales, risk appetite and tolerance statements, and periodic refresh triggers (new markets, new products, mergers, enforcement actions).
- Data sources: internal audit findings, hotline trends, monitoring results, regulatory changes, industry benchmarking, and business-unit input.
- Mitigation hierarchy: avoid, reduce, transfer, accept - with documented rationale for acceptance.
- Dynamic risk: risk assessment is a cycle, not a one-time exercise.
Traps
A frequent error is treating a risk assessment as a compliance-department-only product; credible assessment requires business input and challenge. Another trap is confusing inherent and residual risk when a question asks whether a control is effective. Questions may also suggest a static annual assessment is sufficient; the better answer usually includes trigger-based updates. Beware answers that rank risk purely by reputational concern without a defensible methodology.
Rule of thumb
Risk score = likelihood × impact, applied to inherent risk first; then evaluate whether controls reduce residual risk to within appetite. If residual risk exceeds tolerance, escalate rather than accept silently.
Worked example
A firm enters a new jurisdiction with unfamiliar intermediary rules. The best answer: perform a targeted risk assessment before launch, identify third-party and bribery risks, apply enhanced due diligence and monitoring, and document acceptance of any residual risk at the appropriate senior level.