Risk Assessment
What is tested
Risk assessment identifies, prioritizes, and sizes the compliance risks the program must address. Know the formula risk equals likelihood times impact; inherent versus residual risk; risk appetite and tolerance; the risk register; and the difference between enterprise, compliance, and fraud risk assessments. Inputs include interviews, workshops, data analytics, regulatory change, industry enforcement trends, audit findings, hotline trends, and third-party or geographic exposure.
Concepts to name
Top-down and bottom-up methods, qualitative versus quantitative scoring, heat maps, controls mapping, and refresh cadence. The DOJ asks whether the risk assessment is current, based on continuous access to relevant data, and updated when the business changes - new markets, products, distribution models, or acquisitions.
Traps
A three-year cycle with no interim update is a classic wrong answer. Risk assessment is neither an audit nor a control; it informs both. Watch for confusion between inherent and residual scores, and for programs that rank risk but then allocate resources without reference to the ranking.
Rule of thumb
Every high residual risk should trace to a named control, a monitoring activity, and a training module. If a risk appears on the heat map but nowhere in the annual plan, the assessment was decorative.
Worked example
A company enters a high-corruption-risk market through local agents. Likelihood rises (third-party interface) and impact is severe. The response is not a general refresher; it is agent due diligence, contractual audit rights, enhanced payment monitoring, and targeted training for the commercial team - followed by a scheduled re-score to measure residual risk.