Risk Management and Compliance Controls
Risk Management and Compliance Controls tests risk identification, control design, AML/KYC, recordkeeping, business continuity, and supervisory expectations. The exam treats compliance as a control system, not a one-time legal check.
Core rules
- Main risk types: market, credit, liquidity, operational, legal/regulatory, and reputational.
- The risk process is identify, measure, monitor, control, and report; risk appetite and limits make it operational.
- Segregation of duties, authorization limits, reconciliation, and independent review reduce operational risk.
- AML/KYC controls include customer due diligence, beneficial-ownership checks, ongoing monitoring, and suspicious-transaction reporting.
- Records must be accurate, retained, and retrievable; suitability and complaint records support supervision.
- Business continuity and cybersecurity controls protect data and preserve service during disruption.
Worked example
An adviser emails a client list to a personal account to 'work from home.' Analysis: this is an operational and data-privacy incident, not a minor convenience. Controls include access restrictions, encryption, approved remote-access tools, data-loss prevention, training, and incident response. Deleting the email after the fact does not cure the breach; it may destroy evidence and worsen the breach.
Traps
Do not treat compliance as only legal. Do not assume AML applies only to large transactions. Do not ignore people and process risk in operational risk. Do not keep client data without a lawful basis. Do not confuse a control failure with a market loss.