Risk Assessment, Monitoring, and Audit: Inherent Risk, Controls, and Independent Testing
This domain tests how a bank identifies compliance risk, designs monitoring, and uses audit for independent assurance. Expect questions on inherent and residual risk, control design, testing, sampling, issue management, root cause, and reporting.
Core rules
- A compliance risk assessment rates each activity by inherent risk, considering likelihood and impact, then adjusts for control effectiveness to produce residual risk.
- Monitoring is ongoing management testing owned by compliance or the business; it asks whether controls are working in daily operations.
- Audit is independent, objective assurance, typically performed by internal audit or a qualified third party, and reports to the audit committee.
- Testing should define the population, sample, test steps, evidence, exceptions, and conclusion. Sampling should be defensible for the risk and population.
- Issue management includes root cause, owner, action plan, due date, validation, and escalation. Repeat findings signal weak governance.
Worked example
A bank launches a high-risk deposit product with third-party account opening. The risk assessment rates inherent risk high because of new customers, remote identity verification, and funds availability. Compliance monitoring samples new accounts for CIP exceptions, duplicate identities, and Reg CC holds. Internal audit later tests whether monitoring itself is designed and operating effectively. Reasoning: monitoring can catch exceptions, but audit must independently assess whether the monitoring and controls are reliable. If monitoring finds exceptions but no one fixes them, the issue is not the sample; it is issue management.
Traps that cost marks
- Treating monitoring as independent audit or assuming audit owns the control.
- Using a sample that is too small or not random without explaining the basis.
- Reporting exceptions without root cause, ownership, or validation.
- Leaving the risk assessment unchanged after a new product, vendor, or enforcement action.
- Accepting “training completed” as evidence that the control operates effectively.
Exam focus
Distinguish inherent risk, control effectiveness, residual risk, monitoring, and audit. Then ask what evidence proves the conclusion.