Risk Assessment and Investigation Prioritisation
Risk Assessment and Investigation Prioritisation
This domain tests how an enterprise-wide risk assessment cascades into case-level scoring, and how an investigator sequences a queue when resources are finite. Expect scenario questions with several open alerts and a limited number of analysts.
Core rules
- The enterprise-wide risk assessment identifies inherent risk across customer, product, channel and geography, then applies control effectiveness to reach residual risk. Case scoring should mirror those same dimensions so the two views reconcile.
- Prioritise on risk, not volume. Inputs include potential harm, likelihood or confidence, exposure amount, the customer's risk rating, typology severity, regulatory deadlines and ageing.
- Aged alerts are themselves a risk. Regulators routinely cite backlog and alert ageing as evidence of a weak control environment.
- The risk appetite statement defines what the institution will not tolerate. Anything exceeding it escalates immediately, regardless of queue position.
- Written, consistent scoring criteria prevent arbitrary prioritisation. Recalibrate when typologies, threat reporting or business mix change.
- Static ratings are a trap. Trigger-based reviews should fire when adverse media, a sanctions hit or a law enforcement enquiry appears.
Worked example
Two alerts are open. Alert A: a single $9,500 transfer from a salaried, low-risk customer, three days old. Alert B: recurring $40,000 inflows from unrelated third parties into a shelf company with nominee directors, forty-five days old, beneficial ownership unresolved. Amount favours A. Everything else favours B: unknown ownership, mismatch with the declared profile, a shell-company layering typology, and significant ageing. Score B higher and action it first; keep A in the queue with a documented target date.
Traps that cost marks
- Prioritising by transaction amount alone.
- Bulk-closing old alerts to clear a key performance indicator without analysis.
- Never updating a customer risk rating after adverse media or a changed business model.
- Using one factor, such as geography, as a proxy for the whole risk assessment.