Risk Identification, Assessment and Risk Appetite
Domain 2 tests whether you can build and defend a risk assessment: how inherent risk is identified across customers, products, channels and geographies, how controls convert it into residual risk, and how residual risk is measured against a board-approved appetite.
Inherent, residual and the risk equation
Inherent risk is exposure before controls; residual risk is what remains once controls operate. The gap is control effectiveness, and it must be evidenced rather than asserted. A typical exam calculation asks you to score a segment, apply a control discount, and then test the result against appetite.
The four risk dimensions
- Customer: occupation, PEP status, legal structure, ownership complexity, source of wealth and funds.
- Product or service: cash intensity, anonymity, cross-border capability, stored value, trade finance.
- Channel: face-to-face versus non-face-to-face, agents, introducers, intermediaries, mobile onboarding.
- Geography: FATF call-for-action jurisdictions, sanctions exposure, corruption perception, secrecy regimes.
Each dimension needs a documented rationale and weighting. Matrices where the only variable that moves the score is 'high-risk country' are usually challenged.
Appetite, tolerance and KRIs
An appetite statement declares the risk the institution will accept in pursuit of strategy; tolerances set quantitative boundaries; key risk indicators provide early warning (alerts per 1,000 customers, overdue CDD reviews, screening false-positive rate, STR volumes, training completion). Appetite is board-approved and cascades into business-level risk assessments, which feed the enterprise-wide assessment.
Worked example
A wealth manager scores a new segment: non-resident customers whose wealth derives from property sales, introduced by a law firm in a jurisdiction under increased monitoring. Inherent risk is high on customer and geography, medium on product, and high on channel because of third-party introduction. Documented controls (enhanced source-of-wealth evidence, on-site visits to introducers, quarterly reviews) reduce this to medium-high residual. Appetite allows high risk only with board sign-off, so the segment launches only under conditional approval with monthly KRI reporting.
Traps that cost marks
- Scoring residual risk without citing the evidence that controls are operating.
- Treating grey and black lists as the whole of country risk, ignoring corruption and secrecy indicators.
- Static assessments that ignore changed typologies, sanctions programmes or customer behaviour.
- Confusing enterprise or business risk assessment with an individual customer risk rating.