Risk Mitigation, Controls and Testing
Domain 8 tests whether you can identify controls, judge their design and operating effectiveness, and prove remediation: the mechanics of testing, sampling, root cause analysis, and issue management.
Control types
- Preventive controls stop an event: CDD before onboarding, sanctions screening before payment release, dual authorisation.
- Detective controls find events after the fact: monitoring alerts, quality assurance reviews, reconciliations.
- Corrective controls respond: freezing, exit, remediation, lookback reviews.
Controls map to specific risks. A control tested in isolation without a mapped risk is hard to defend.
Design versus operating effectiveness
Design testing asks whether the control, as written, would mitigate the risk if performed. Operating effectiveness asks whether it was actually performed consistently over the period. Evidence includes system logs, approval records, sample file reviews and exception reports. Sampling should be risk-based and statistically defensible, not convenience-based.
Root cause and remediation
Exceptions are grouped to find causes: unclear procedures, incentive structures, system gaps, training failures, or poor escalation culture. Remediation needs an owner, deadline, validation and, where relevant, a lookback over previously affected files.
Worked example
A file review of 60 high-risk CDD files finds seven without source-of-wealth evidence. Checking the procedure shows it is clear, but branch performance targets reward fast onboarding. Design is adequate; operating effectiveness failed, and the root cause is an incentive conflict rather than a documentation gap. The correct response combines lookback on other branch files, incentive review, targeted training and re-testing, not simply an email reminding staff of the procedure.
Traps that cost marks
- Testing whether the procedure exists rather than whether it was followed.
- Sampling the easiest files instead of the highest-risk ones.
- Closing an issue without independent validation.
- Concluding a control is effective because no alerts were raised, when the scenario may not cover the risk.
- Treating de-risking as mitigation when it simply moves the risk elsewhere without assessment.