Common weaknesses in entity-wide risk assessments

[PLACEHOLDER — awaiting review] This article is general commentary written as seed content. Review it for accuracy and house style, and have it signed off before publication. It is not legal or regulatory advice.

The entity-wide risk assessment is meant to be the document that drives everything else. The control environment is supposed to be calibrated to it, the customer risk methodology is supposed to descend from it, and resourcing decisions are supposed to follow it.

In practice it is often the document that is produced once, filed, and consulted only when someone asks to see it.

Six recurring weaknesses

1. Inherent risk assessed after controls

Inherent risk is the exposure before mitigation. When an assessment records low inherent risk because strong controls exist, the two concepts have collapsed into one and the residual risk calculation no longer means anything.

2. Risk factors asserted rather than evidenced

“The client base is predominantly low risk” is a conclusion. Without the distribution of client risk ratings, jurisdictions and structures behind it, it is an assertion — and it is the first thing a reviewer will ask to see supported.

3. No link to the customer risk methodology

If the entity-wide assessment identifies a specific elevated exposure, that exposure should be visible as a weighted factor in how individual clients are rated. Where the two documents were written separately, they usually disagree.

4. Geographic risk reduced to a list

Naming high-risk jurisdictions is not the same as assessing exposure to them. The relevant question is what proportion of the book touches those jurisdictions, in what capacity — incorporation, operation, source of funds, source of wealth, counterparty — and what is done differently as a result.

5. No reassessment trigger

An assessment should be revisited when the business changes materially: a new product, a new market, a new delivery channel, a significant change in client mix. Where no trigger is defined, reassessment happens annually at best and by accident at worst.

6. Conclusions that never move

The clearest signal that an assessment is not being used is that its ratings are identical to last year’s, and the year before, through a period in which the business demonstrably changed.

A reasonable test

Read the assessment and then ask: if this document had reached a different conclusion, what would the entity be doing differently?

If the answer is nothing, the assessment is not driving the compliance programme. It is describing it after the fact — and that is a materially different thing.