Risk Management and Compliance
This domain tests how compliance risk is identified, assessed, and managed within the firm's wider risk framework, including the risk-based approach to AML/CFT.
Core mechanics
Assess inherent risk before controls and residual risk after controls. Use likelihood and impact, define risk appetite and tolerance, and record results in a risk register. For AML/CFT, risk factors include customer type, product, delivery channel, geography, and transaction behaviour.
Controls and risk appetite
Controls may be preventive, detective, manual, or automated. The compliance officer should challenge whether controls are proportionate to the risk and whether exceptions are escalated. Risk appetite statements are meaningless unless breaches trigger action.
Worked example
A firm onboards a politically exposed person with complex offshore structures. The risk assessment rates inherent risk high. Enhanced due diligence, senior approval, and source-of-wealth checks reduce residual risk to medium. Reasoning: the rating must reflect both the customer profile and the strength of the controls actually applied, not the relationship manager's opinion.
Traps that cost marks
- Scoring risk qualitatively without any defined scale.
- Treating residual risk as low because controls are 'in place' but untested.
- Omitting new products, channels, or technologies from the assessment.
- Failing to update the assessment after a breach or regulatory change.
Risk-based does not mean risk-free or arbitrary; it means documented, proportionate, and reviewed.