Crypto Custody Added, Residual Risk Falls: Auditing the Enterprise-Wide Risk Assessment
Ridgeline Bank, with about $8 billion in assets, began offering crypto asset custody to institutional clients nine months ago and now holds keys for 41 clients representing $600 million. The BSA officer builds the enterprise-wide money laundering risk assessment in a vendor tool: 14 risk factors, each scored 1 to 5 and weighted, aggregated into inherent risk, then reduced by control-effectiveness scores that the business line supplies. The custody product was entered as a new customer type, but no factor captures blockchain exposure, mixers, or unhosted-wallet screening. Control-effectiveness scores for custody were completed by the product head, who also owns the revenue target. The residual rating fell from 2.9 to 2.7 year over year. The board compliance committee received a two-page summary, and minutes show no questions. Internal audit must decide whether the assessment is sound enough to drive the annual audit plan and what to report.
1. Identify the two most consequential weaknesses in this risk assessment process and explain why each matters for audit reliance.
Read the worked answer
The first weakness is that inherent risk is not assessed independently of controls. Custody control-effectiveness scores came from the product head, who is compensated on growth and has no incentive to rate his own controls weak. Because the tool nets those scores against inherent risk, an optimistic self-assessment mechanically lowers residual risk. Audit cannot treat the 2.7 as an objective measure unless the control scores are independently validated.
The second weakness is that the factor taxonomy was not changed at launch. Fourteen generic factors apparently capture customer type but not blockchain-specific exposure: mixers, privacy coins, unhosted wallets, and the quality of wallet screening. A new activity can be added as a customer type and still be underweighted if no factor measures its defining risk. The drop from 2.9 to 2.7 is itself a red flag. A genuinely new, higher-risk product should not reduce enterprise residual risk without a documented explanation.
Both are design weaknesses, not execution slips. That means the risk assessment may not be a reliable basis for scoping audit coverage or for board oversight, which is the point to report, not simply that the form was completed on time.
2. Design the procedures you would perform to determine whether the 2.7 residual rating is supportable, naming the evidence you would obtain.
Read the worked answer
Reconstruct the score from source data rather than accepting tool output. Obtain factor definitions, weights, and the scoring rubric, then independently re-score the 14 factors using your own evidence, and run a sensitivity test: add a blockchain-exposure factor at 5 with a plausible weight and show what residual risk becomes. If residual moves above the board-approved risk appetite threshold, the conclusion follows.
For controls, do not accept the product head's ratings. Walk through wallet screening: how many of the 41 clients were screened at onboarding, how many alerts fired, how each was dispositioned, and whether screening covers unhosted wallets and mixers. Sample ten clients against the full CIP and CDD file. Interview the analysts who actually run screening, not only the product head. Inspect the methodology document for approval, version control, and any model validation, and confirm whether the board approved the change that added custody. Benchmark the factor set against published guidance.
Document each procedure and the evidence relied on. If the independent re-score materially exceeds the reported residual, the rating is unsupportable and the audit plan's risk allocation must be revisited.
3. The audit committee asks whether this should be called a significant deficiency. How do you frame the answer?
Read the worked answer
Frame it against the bank's deficiency definitions rather than the label. A significant deficiency is less severe than a material weakness but important enough to merit attention from those charged with governance. The test is likelihood and magnitude of noncompliance.
Here the risk-assessment process failed twice: control ratings were not independent, and change management did not update the taxonomy for a new high-risk product. The consequence is that the board was told risk was falling while the bank launched an unfamiliar exposure. That is a governance and information-quality issue, not yet proof of an AML failure. Whether it is significant depends on what the weakened assessment caused. If custody received fewer monitoring resources, or if wallet screening turns out not to cover unhosted wallets, the deficiency likely rises to significant, because undetected laundering becomes plausible and could affect multiple clients.
I would report at minimum a control deficiency in the risk assessment process, escalate to significant if substantive testing confirms a screening or monitoring gap, and state exactly which evidence drove the conclusion. Avoid calling it a material weakness without evidence of actual reporting or regulatory failure.